critical
CVE-2021-22931
nodejs: Improper handling of untypical characters in domain names
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.0CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami, CBL-Mariner, Photon OS. Rated lower by AlmaLinux (high), Oracle (high), Rocky Linux (high), Red Hat (medium).
Description
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node, node-min | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| CBL-Mariner 1.0 | nodejs | 0:14.17.5-1.cm1 |
| CBL-Mariner 2.0 | nodejs, python-gevent | 0:16.14.0-1.cm2 and 1 more |
| Photon OS 4.0 | nodejs, nodejs-devel | 14.17.5-1.ph4 |
| alma 8 | nodejs:12::nodejs, nodejs:12::nodejs-devel, nodejs:12::nodejs-docs and 6 more | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 and 4 more |
| alpine 3.11 | nodejs | 12.22.5-r0 |
| alpine 3.12 | nodejs | 12.22.5-r0 |
| alpine 3.13 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs, nodejs-current | 14.17.5-r0 and 1 more |
| alpine 3.15 | nodejs, nodejs-current | 14.17.5-r0 and 1 more |
| alpine 3.16 | nodejs, nodejs-current | 14.17.5-r0 and 1 more |
| alpine 3.17 | nodejs, nodejs-current | 14.17.5-r0 and 1 more |
Show all 69 entries from 22 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| bitnami::Bitnami Vulnerability Database | node-min | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| CBL-Mariner 1.0 | nodejs | 0:14.17.5-1.cm1 |
| CBL-Mariner 2.0 | nodejs | 0:16.14.0-1.cm2 |
| CBL-Mariner 2.0 | python-gevent | 0:21.1.2-3.cm2 |
| Photon OS 4.0 | nodejs | 14.17.5-1.ph4 |
| Photon OS 4.0 | nodejs-devel | 14.17.5-1.ph4 |
| alma 8 | nodejs:12::nodejs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-devel | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-docs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-full-i18n | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:12::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:12::npm | 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:14::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:14::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alpine 3.11 | nodejs | 12.22.5-r0 |
| alpine 3.12 | nodejs | 12.22.5-r0 |
| alpine 3.13 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs-current | 16.11.1-r0 |
| alpine 3.15 | nodejs | 14.17.5-r0 |
| alpine 3.15 | nodejs-current | 16.6.2-r0 |
| alpine 3.16 | nodejs | 14.17.5-r0 |
| alpine 3.16 | nodejs-current | 16.6.2-r0 |
| alpine 3.17 | nodejs | 14.17.5-r0 |
| alpine 3.17 | nodejs-current | 16.6.2-r0 |
| alpine 3.18 | nodejs | 14.17.5-r0 |
| alpine 3.18 | nodejs-current | 16.6.2-r0 |
| alpine 3.19 | nodejs | 14.17.5-r0 |
| alpine 3.19 | nodejs-current | 16.6.2-r0 |
| alpine 3.20 | nodejs | 14.17.5-r0 |
| alpine 3.20 | nodejs-current | 16.6.2-r0 |
| alpine 3.21 | nodejs | 14.17.5-r0 |
| alpine 3.21 | nodejs-current | 16.6.2-r0 |
| alpine 3.22 | nodejs | 14.17.5-r0 |
| alpine 3.22 | nodejs-current | 16.6.2-r0 |
| alpine 3.23 | nodejs | 14.17.5-r0 |
| alpine 3.23 | nodejs-current | 16.6.2-r0 |
| alpine 3.24 | nodejs | 14.17.5-r0 |
| alpine 3.24 | nodejs-current | 16.6.2-r0 |
| alpine edge | nodejs | 14.17.5-r0 |
| alpine edge | nodejs-current | 16.6.2-r0 |
| Oracle Linux 8 | nodejs | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-devel | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-docs | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-full-i18n | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.3-1.module+el8.4.0+20281+eb64e322 |
| Oracle Linux 8 | nodejs-packaging | 23-3.module+el8.3.0+7818+6cd30d85 |
| Oracle Linux 8 | npm | 1:6.14.14-1.14.17.5.1.module+el8.4.0+20313+f90c2973 |
| rocky 8 | nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-devel | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-docs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-full-i18n | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-devel | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-docs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-full-i18n | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:12::npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:14::nodejs | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-devel | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-docs | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-full-i18n | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-nodemon | 2.0.3-1.module+el8.4.0+638+5344c6f7 |
| rocky 8 | nodejs:14::nodejs-packaging | 23-3.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::npm | 1:6.14.14-1.14.17.5.1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+647+e905fa21 |
References
- https://access.redhat.com/errata/RHSA-2021:3666
- https://access.redhat.com/security/cve/CVE-2021-22931
- https://bugzilla.redhat.com/1956818
- https://bugzilla.redhat.com/1988342
- https://bugzilla.redhat.com/1988394
- https://bugzilla.redhat.com/1990409
- https://bugzilla.redhat.com/1990415
- https://bugzilla.redhat.com/1993019
All 43 references
- https://bugzilla.redhat.com/1993029
- https://bugzilla.redhat.com/1993039
- https://bugzilla.redhat.com/1993924
- https://bugzilla.redhat.com/show_bug.cgi?id=1956818
- https://bugzilla.redhat.com/show_bug.cgi?id=1988342
- https://bugzilla.redhat.com/show_bug.cgi?id=1988394
- https://bugzilla.redhat.com/show_bug.cgi?id=1990409
- https://bugzilla.redhat.com/show_bug.cgi?id=1990415
- https://bugzilla.redhat.com/show_bug.cgi?id=1993019
- https://bugzilla.redhat.com/show_bug.cgi?id=1993029
- https://bugzilla.redhat.com/show_bug.cgi?id=1993039
- https://bugzilla.redhat.com/show_bug.cgi?id=1993924
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22931
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22939
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22940
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23343
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32803
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32804
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3672
- https://errata.almalinux.org/8/ALSA-2021-3666.html
- https://errata.rockylinux.org/RLSA-2021:3666
- https://hackerone.com/reports/1178337
- https://linux.oracle.com/cve/CVE-2021-22931.html
- https://linux.oracle.com/errata/ELSA-2021-3666.html
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://nvd.nist.gov/vuln/detail/CVE-2021-22931
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210923-0001/
- https://security.netapp.com/advisory/ntap-20211022-0003/
- https://www.cve.org/CVERecord?id=CVE-2021-22931
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html