A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versi

Summary

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.

Timeline

1. Nov 19, 2020, 12:32 AM UTCCVE published
2. Apr 30, 2025, 10:24 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• NodeJS Node

  From 4.0; From 5.0; From 6.0; From 7.0; From 8.0; From 9.0; From 11.0; From 12.0 · fixed in 12.19.1; From 13.0; From 14.0 · fixed in 14.15.1; From 15.0 · fixed in 15.2.1

References 15