What’s Vulnerable › Vulnerabilities

CVE-2021-23386: Remote Memory Exposure

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-20 · updated 2026-06-17
• Weakness: CWE-909

Description

This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

Affected products

• dns-packet: before 1.3.4; from 2.0.0 before 5.2.2 — fixed in 1.3.4, 5.2.2
• Npm Dns-Packet: from 2.0.0 before 5.2.2; before 1.3.2 — fixed in 5.2.2, 1.3.2

How to fix

Upgrade to a fixed version: dns-packet 1.3.4, 5.2.2; Npm Dns-Packet 5.2.2, 1.3.2. Check the vendor advisory for mitigations.

References

• https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56
• https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719
• https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563
• https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56
• https://hackerone.com/bugs?subject=user&amp%3Breport_id=968858
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719
• https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563

Get alerted when CVE-2021-23386 or the next vulnerability affects your stack