CVE-2021-22931 is a critical remote code execution, XSS, and application crash vulnerability affecting Node.js versions prior to 16.6.0, 14.17.4, and 12.22.4, as well as products from NetApp, Oracle, and Siemens. The flaw stems from missing input validation in the Node.js DNS library, allowing attackers to inject malicious hostnames, leading to domain hijacking and other injection vulnerabilities. With a CVSS score of 9.8 (CRITICAL), this vulnerability poses a significant risk due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability. While no public exploits (Metasploit, Nuclei, ExploitDB) are currently known, and there is minimal community discussion or media coverage, its high FAUCET Risk Score of 79/100 indicates a substantial potential threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 12.0, < 12.22.5CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 14.0, < 14.17.5CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 16.0, < 16.6.2CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 12.0.0, <= 12.12.0CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
>= 12.13.0, < 12.22.5CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2021-22931
Dec 14, 2021nodejs: Improper handling of untypical characters in domain names
Aug 11, 2021Node.js before 16.6.0 14.17.4 and 12.22.4 is vulnerable to Remote Code Execution XSS Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Aug 10, 2021