What’s Vulnerable › Vulnerabilities

CVE-2021-22884

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 36.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-03-03 · updated 2026-06-17
• Weakness: CWE-350

Description

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.

Affected products

• Fedoraproject Fedora: 32, 33, 34
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• NetApp E-Series Performance Analyzer: all versions
• OnCommand Insight: all versions
• NetApp OnCommand Workflow Automation: all versions
• NetApp SnapCenter: all versions
• Node.js: from 10.0.0 before 10.24.0; from 12.0.0 before 12.21.0; from 14.0.0 before 14.16.0; from 15.0.0 before 15.10.0 — fixed in 10.24.0, 12.21.0, 14.16.0, 15.10.0
• Oracle Corporation GraalVM Enterprise Edition: 19.3.5, 20.3.1.2, 21.0.0.2
• Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.6.0 — fixed in 9.2.6.0
• Oracle Corporation MySQL Cluster: through 8.0.25
• Oracle Nosql Database: before 20.3 — fixed in 20.3
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1

How to fix

Upgrade to a fixed version: Node.js 10.24.0, 12.21.0, 14.16.0, 15.10.0; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.6.0; Oracle Nosql Database 20.3; Siemens Sinec Infrastructure Network Services 1.0.1.1. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://hackerone.com/reports/1069487
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7XIJQNGIKUXG2DJFHLO7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F45Y7TXSU33MTKB6AGL2Q5V5ZOCNPKOG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSYFUGKFUSZ27M5TEZ3FKILWTWFJTFAZ/
• https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/
• https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/#node-js-inspector-dns-rebinding-vulnerability-cve-2018-7160
• https://security.netapp.com/advisory/ntap-20210416-0001/
• https://security.netapp.com/advisory/ntap-20210723-0001/
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpuoct2021.html

Get alerted when CVE-2021-22884 or the next vulnerability affects your stack