CVE-2020-8277: Buffer Overflow
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
Other sources
Denial of Service through DNS request (High). A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service by getting the application to resolve a DNS record with a larger number of responses.
Reference: https://github.com/c-ares/c-ares/issues/371
Upstream patch: https://github.com/c-ares/c-ares/commit/0d252eb3b2147179296a3bdb4ef97883c97c54d3
— Red Hat
Node.js is vulnerable to a denial of service. By getting the application to resolve a DNS record with a larger number of responses, an attacker could exploit this vulnerability to trigger a DNS request for a host of their choice resulting in a denial of service.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8277?
CVE-2020-8277 is a vulnerability in Node.js that allows an attacker to trigger a Denial of Service by getting the application to resolve a DNS record with a larger number of responses.
Which versions of Node.js are affected by CVE-2020-8277?
Versions < 15.2.1, < 14.15.1, and < 12.19.1 of Node.js are affected by CVE-2020-8277.
How can I fix CVE-2020-8277?
To fix CVE-2020-8277, update your Node.js installation to version 15.2.1, 14.15.1, or 12.19.1 or higher.
What is the severity of CVE-2020-8277?
CVE-2020-8277 has a severity of 7.5 (high).
Where can I find more information about CVE-2020-8277?
More information about CVE-2020-8277 can be found on the GitHub page and the Red Hat Bugzilla page.