CVE-2021-22884

Summary

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.

Affected Software

VendorProductVersion RangeStatus
NodeJSNode4.0 < 4.*affected
NodeJSNode5.0 < 5.*affected
NodeJSNode6.0 < 6.*affected
NodeJSNode7.0 < 7.*affected
NodeJSNode8.0 < 8.*affected
NodeJSNode9.0 < 9.*affected
NodeJSNode10.0 < 10.24.0affected
NodeJSNode11.0 < 11.*affected
NodeJSNode12.0 < 12.21.0affected
NodeJSNode13.0 < 13.*affected
NodeJSNode14.0 < 14.16.0affected
NodeJSNode15.0 < 15.10.0affected

Weaknesses

  • CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)

ADP Enrichment

CVE Program Container

Additional References

References