p PatchFirst

CVE-2021-22884

CVE-2021-22884

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.

CVSS 7.5 · High · EPSS 36.8% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node.js

    Versions
    • ≥ 4.0, < 4.*: Affected (semver)
    • ≥ 5.0, < 5.*: Affected (semver)
    • ≥ 6.0, < 6.*: Affected (semver)
    • ≥ 7.0, < 7.*: Affected (semver)
    • ≥ 8.0, < 8.*: Affected (semver)
    • ≥ 9.0, < 9.*: Affected (semver)
    • ≥ 10.0, < 10.24.0: Affected (semver)
    • ≥ 11.0, < 11.*: Affected (semver)
    • ≥ 12.0, < 12.21.0: Affected (semver)
    • ≥ 13.0, < 13.*: Affected (semver)
    • ≥ 14.0, < 14.16.0: Affected (semver)
    • ≥ 15.0, < 15.10.0: Affected (semver)

    Update to 10.24.0; Update to 12.21.0; Update to 14.16.0; Update to 15.10.0

  • nodejs Debian:12

    Affected ranges
    • ECOSYSTEM: < 12.21.0~dfsg-1

    Update to 12.21.0~dfsg-1

  • nodejs Debian:13

    Affected ranges
    • ECOSYSTEM: < 12.21.0~dfsg-1

    Update to 12.21.0~dfsg-1

  • nodejs Debian:14

    Affected ranges
    • ECOSYSTEM: < 12.21.0~dfsg-1

    Update to 12.21.0~dfsg-1

  • nodejs Ubuntu:Pro:18.04:LTS

    Versions
    • 6.11.4~dfsg-1ubuntu1
    • 6.11.4~dfsg-1ubuntu2
    • 6.12.0~dfsg-1ubuntu1
    • 6.12.0~dfsg-2ubuntu1
    • 6.12.0~dfsg-2ubuntu2
    • 8.10.0~dfsg-2
    • 8.10.0~dfsg-2ubuntu0.2
    • 8.10.0~dfsg-2ubuntu0.3
    • 8.10.0~dfsg-2ubuntu0.4
    • 8.10.0~dfsg-2ubuntu0.4+esm1
    • 8.10.0~dfsg-2ubuntu0.4+esm2
    Affected ranges
    • ECOSYSTEM: < 8.10.0~dfsg-2ubuntu0.4+esm3

    Update to 8.10.0~dfsg-2ubuntu0.4+esm3

  • nodejs Ubuntu:20.04:LTS

    Versions
    • 10.15.2~dfsg-2ubuntu1
    • 10.17.0~dfsg-2ubuntu4
    • 10.17.0~dfsg-2ubuntu6
    • 10.19.0~dfsg-3ubuntu1
    • 10.19.0~dfsg-3ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 10.19.0~dfsg-3ubuntu1.2

    Update to 10.19.0~dfsg-3ubuntu1.2

Original sources

Check your server →