CVE-2021-22931

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 16.6.0 Node.js versions prior to 14.17.4 Node.js versions prior to 12.22.4

Description The issue is related to the Node.js dns library, which lacks proper input validation of host names returned by Domain Name Servers. This can lead to the output of wrong hostnames, resulting in domain hijacking and injection vulnerabilities in applications using the library. The vulnerability can be exploited by a remote attacker to gain access to confidential data, compromise data integrity, and cause a denial of service. The vulnerability is associated with incorrect handling of unusual characters in domain names.

Recommendations For versions prior to 16.6.0, update to version 16.6.0 or later. For versions prior to 14.17.4, update to version 14.17.4 or later. For versions prior to 12.22.4, update to version 12.22.4 or later.