CVE-2021-22931

Name	CVE-2021-22931
Description	Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nodejs (PTS)	bullseye (security), bullseye	12.22.12~dfsg-1~deb11u4	fixed
	bookworm	18.19.0+dfsg-6~deb12u2	fixed
	bookworm (security)	18.19.0+dfsg-6~deb12u1	fixed
	trixie	20.15.0+dfsg-1	fixed
	sid	20.15.1+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nodejs	source	(unstable)	(not affected)

Notes

- nodejs <not-affected> (Debian builds nodejs against src:c-ares)
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#cares-upgrade-improper-handling-of-untypical-characters-in-domain-names-high-cve-2021-22931