CVE-2021-22931

NameCVE-2021-22931
DescriptionNode.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nodejs (PTS)stretch4.8.2~dfsg-1fixed
buster, buster (security)10.24.0~dfsg-1~deb10u1fixed
bullseye12.21.0~dfsg-5fixed
bullseye (security)12.22.5~dfsg-2~11u1fixed
bookworm12.22.5~dfsg-2fixed
sid12.22.5~dfsg-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nodejssource(unstable)(not affected)

Notes

- nodejs <not-affected> (Debian builds nodejs against src:c-ares)
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#cares-upgrade-improper-handling-of-untypical-characters-in-domain-names-high-cve-2021-22931

Search for package or bug name: Reporting problems