Denial of Service Vulnerability in Node.js
Summary
CVE-2020-8277: A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a D... Affects nodejs across 3 version ranges.
< 12.20.1-r0
>= 63d1e08e64e7e09408eb63cd8dd7c65ad766f277, < f95d7152cb9f56b3d6ca8e107a01c199b235c0df
< 077a587dccbe2f0d8a1987fbd3525333705c2249
Fixed in 12.20.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable and high-performance applications. However, a vulnerability has been discovered in Node.js that could lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2020-8277, allows an attacker to trigger a DNS request for a host of their choice, resulting in a DoS attack. This vulnerability affects Node.js versions prior to 15.2.1, 14.15.1, and 12.19.1. By exploiting this vulnerability, an attacker can cause the application to resolve a DNS record with a larger number of responses, leading to a DoS condition. The issue has been fixed in the mentioned versions.
How To Fix
Minimum fixed version
12.20.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update to the fixed versions as soon as possible.
Conclusion
The Denial of Service vulnerability in Node.js (CVE-2020-8277) can be exploited by an attacker to trigger a DoS attack. It is crucial to update to the fixed versions (15.2.1, 14.15.1, or 12.19.1) to mitigate the risk of this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
This vulnerability can be exploited by an attacker to trigger a DoS attack, causing the affected Node.js application to become unresponsive or crash.
Versions of Node.js prior to 15.2.1, 14.15.1, and 12.19.1 are affected by this vulnerability.
Yes, the vulnerability has been fixed in Node.js versions 15.2.1, 14.15.1, and 12.19.1.
No specific workarounds have been mentioned for this vulnerability. It is recommended to update to the fixed versions.
You can find more information about this vulnerability in the CVE-2020-8277 JSON file available at the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
