Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Weakness
The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Node.js | Nodejs | 12.0.0 (including) | 12.12.0 (including) |
| Node.js | Nodejs | 12.13.0 (including) | 12.22.5 (excluding) |
| Node.js | Nodejs | 14.0.0 (including) | 14.14.0 (including) |
| Node.js | Nodejs | 14.15.0 (including) | 14.17.5 (excluding) |
| Node.js | Nodejs | 16.0.0 (including) | 16.6.2 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:12-8040020210817133458.522a0ee4 | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:14-8040020210817165654.522a0ee4 | * |
| Red Hat Enterprise Linux 8.1 Extended Update Support | RedHat | nodejs:12-8010020210817113128.c27ad7f8 | * |
| Red Hat Enterprise Linux 8.2 Extended Update Support | RedHat | nodejs:12-8020020210817125332.4cda2c84 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs14-nodejs-0:14.17.5-1.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs12-nodejs-0:12.22.5-1.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs12-nodejs-nodemon-0:2.0.3-5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs14-nodejs-0:14.17.5-1.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs12-nodejs-0:12.22.5-1.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs12-nodejs-nodemon-0:2.0.3-5.el7 | * |
| Nodejs | Ubuntu | bionic | * |
| Nodejs | Ubuntu | hirsute | * |
| Nodejs | Ubuntu | impish | * |
| Nodejs | Ubuntu | kinetic | * |
| Nodejs | Ubuntu | trusty | * |
| Nodejs | Ubuntu | xenial | * |
Potential Mitigations
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1178337
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210923-0001/
- https://security.netapp.com/advisory/ntap-20211022-0003/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1178337
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210923-0001/
- https://security.netapp.com/advisory/ntap-20211022-0003/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html