by Kastro CVE-2021-22931
NodeJS Node — Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validat…
Description · from the CVE record
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Affected
ProductAffectedFixed inSource
Node4.0 – < 4.*4.*CNA
Node5.0 – < 5.*5.*CNA
Node6.0 – < 6.*6.*CNA
Node7.0 – < 7.*7.*CNA
Node8.0 – < 8.*8.*CNA
Node9.0 – < 9.*9.*CNA
Node10.0 – < 10.*10.*CNA
Node11.0 – < 11.*11.*CNA
Node12.0 – < 12.22.512.22.5CNA
Node13.0 – < 13.*13.*CNA
Node14.0 – < 14.17.514.17.5CNA
Node15.0 – < 15.*15.*CNA
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total