CVE-2017-1000381

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-07-07 · updated 2026-06-17
Weakness: CWE-200

Description

The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.

Affected products

c-ares: 1.8.0, 1.9.0, 1.9.1, 1.10.0, 1.12.0
C-Ares Project C-Ares: 1.11.0, 1.11.0-rc1
Node.js: from 4.0.0 through 4.1.2; from 4.2.0 before 4.8.4; from 5.0.0 through 5.12.0; from 6.0.0 through 6.8.1; from 6.9.0 before 6.11.1; from 7.0.0 before 7.10.1 — fixed in 4.8.4, 6.11.1, 7.10.1, 8.1.4

How to fix

Upgrade to a fixed version: Node.js 4.8.4, 6.11.1, 7.10.1, 8.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-1000381 or the next vulnerability affects your stack