CVE-2020-8277 describes a Denial of Service vulnerability in Node.js versions prior to 15.2.1, 14.15.1, and 12.19.1, as well as related products like c-ares_project and Oracle. An attacker can trigger this by causing a vulnerable Node.js application to resolve a DNS record with an unusually large number of responses, leading to service disruption. This vulnerability carries a high CVSS score of 7.5, indicating a network-based attack with low complexity and high impact on availability, requiring no user interaction or privileges. While its EPSS score is notably high, suggesting a higher likelihood of exploitation compared to most CVEs, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 12.16.3, < 12.19.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | ||
>= 14.13.0, < 14.15.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | ||
>= 15.0.0, < 15.2.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
32CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2020-8277
Mar 9, 2021c-ares: ares_parse_{a,aaaa}_reply() insufficient naddrttls validation DoS
Nov 12, 2020A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1 < 14.15.1 and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1 14.15.1 and 12.19.1.
Nov 10, 2020