Node.js before versions 16.4.1, 14.17.2 and 12.22.2 is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.
Node.js before versions 16.4.1, 14.17.2 and 12.22.2 is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv-upgrade-out-of-bounds-read-medium-cve-2021-22918 https://hackerone.com/reports/1209681 https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631829 https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac358 https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc096a7
Vulmon