Homepage

Improper Input Validation The advisory has been revoked - it doesn't affect any version of package nodejs-devel  (opens in a new tab)

Threat Intelligence

EPSS
21.95% (98th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-NODEJSDEVEL-1565076
  • published17 Aug 2021
  • disclosed11 Aug 2021
Report a new vulnerability Found a mistake?

Introduced: 11 Aug 2021

CVE-2021-22931  (opens in a new tab)
CWE-20  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs-devel package and not the nodejs-devel package as distributed by RHEL.

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.