Unrated severityNVD Advisory· Published Mar 3, 2021· Updated Apr 30, 2025
CVE-2021-22884
CVE-2021-22884
Description
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
63- osv-coords61 versionspkg:bitnami/nodepkg:bitnami/node-minpkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/npmpkg:rpm/opensuse/nodejs10&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/nodejs12&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/nodejs14&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/nodejs14&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nodejs8&distro=openSUSE%20Leap%2015.2pkg:rpm/suse/nodejs10&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/nodejs10&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/nodejs10&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/nodejs10&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/nodejs10&distro=SUSE%20Manager%20Server%204.0pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs12&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/nodejs8&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/nodejs8&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/nodejs8&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/nodejs8&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/nodejs8&distro=SUSE%20Manager%20Server%204.0pkg:rpm/suse/nodejs-common&distro=SUSE%20Enterprise%20Storage%206pkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-ESPOSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP2pkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-BCLpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/nodejs-common&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/nodejs-common&distro=SUSE%20Manager%20Proxy%204.0pkg:rpm/suse/nodejs-common&distro=SUSE%20Manager%20Retail%20Branch%20Server%204.0pkg:rpm/suse/nodejs-common&distro=SUSE%20Manager%20Server%204.0
>= 10.0.0, < 10.24.0+ 60 more
- (no CPE)range: >= 10.0.0, < 10.24.0
- (no CPE)range: >= 10.0.0, < 10.24.0
- (no CPE)range: < 1:10.24.0-1.module_el8.5.0+81+7dbe79d3
- (no CPE)range: < 1:10.24.0-1.module_el8.4.0+2224+b07ac28e
- (no CPE)range: < 1:10.24.0-1.module_el8.3.0+2047+b07ac28e
- (no CPE)range: < 1:10.24.0-1.module_el8.5.0+81+7dbe79d3
- (no CPE)range: < 2.0.3-1.module_el8.4.0+2521+c668cc9f
- (no CPE)range: < 17-3.module_el8.4.0+2224+b07ac28e
- (no CPE)range: < 1:6.14.11-1.10.24.0.1.module_el8.5.0+81+7dbe79d3
- (no CPE)range: < 10.24.0-lp152.2.12.1
- (no CPE)range: < 12.21.0-lp152.3.12.1
- (no CPE)range: < 14.16.0-lp152.8.1
- (no CPE)range: < 14.17.5-1.2
- (no CPE)range: < 8.17.0-lp152.3.11.1
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.36.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 10.24.0-1.33.2
- (no CPE)range: < 12.21.0-1.29.2
- (no CPE)range: < 12.21.0-4.13.2
- (no CPE)range: < 14.16.0-6.9.2
- (no CPE)range: < 14.16.0-5.9.1
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-10.9.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 8.17.0-3.47.2
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
- (no CPE)range: < 2.0-3.2.1
Patches
Vulnerability mechanics
References
12- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7XIJQNGIKUXG2DJFHLO7/mitrevendor-advisoryx_refsource_FEDORA
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F45Y7TXSU33MTKB6AGL2Q5V5ZOCNPKOG/mitrevendor-advisoryx_refsource_FEDORA
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSYFUGKFUSZ27M5TEZ3FKILWTWFJTFAZ/mitrevendor-advisoryx_refsource_FEDORA
- cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfmitrex_refsource_CONFIRM
- hackerone.com/reports/1069487mitrex_refsource_MISC
- nodejs.org/en/blog/vulnerability/february-2021-security-releases/mitrex_refsource_MISC
- nodejs.org/en/blog/vulnerability/march-2018-security-releases/mitrex_refsource_MISC
- security.netapp.com/advisory/ntap-20210416-0001/mitrex_refsource_CONFIRM
- security.netapp.com/advisory/ntap-20210723-0001/mitrex_refsource_CONFIRM
- www.oracle.com//security-alerts/cpujul2021.htmlmitrex_refsource_MISC
- www.oracle.com/security-alerts/cpuApr2021.htmlmitrex_refsource_MISC
- www.oracle.com/security-alerts/cpuoct2021.htmlmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.