CVE-2021-22931: Input Validation
A flaw was found in Node.js. These vulnerabilities include remote code execution, Cross-site scripting (XSS), application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library, which can lead to the output of wrong hostnames (leading to Domain hijacking) and injection vulnerabilities in applications using the library.
Other sources
Node.js before 16.6.0 14.17.4 and 12.22.4 is vulnerable to Remote Code Execution XSS Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
— Microsoft
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Node.js could provide weaker than expected security, caused by missing input validation on hostnames returned by DNS servers. An attacker could exploit this vulnerability to cause output of wrong hostnames leading to Domain Hijacking and and injection vulnerabilities in applications using the library.
— IBM
Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
References: https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-22931?
CVE-2021-22931 is a vulnerability found in Node.js that can result in remote code execution, Cross-site scripting (XSS), and application crashes.
What is the severity of CVE-2021-22931?
CVE-2021-22931 has a severity rating of medium.
How does CVE-2021-22931 affect Node.js?
CVE-2021-22931 affects Node.js by causing missing input validation on hostnames returned by Domain Name Servers in the Node.js DNS library.
Which versions of Node.js are affected by CVE-2021-22931?
Node.js versions 12.22.5, 14.17.5, and 16.6.2 are affected by CVE-2021-22931.
How can I fix CVE-2021-22931?
To fix CVE-2021-22931, update Node.js to version 12.22.5, 14.17.5, or 16.6.2.