CVE-2020-8277
HIGH 7.5EPSS 54.2%
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
- Affected
- NodeJS · Node
- CVSS v3.1 NVD
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS v2.0 NVD
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P - EPSS
- 54.16% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2020-11-19
- Updated
- 2025-04-30
Proof-of-concept exploits (2)
- AndrewIjano/CVE-2020-82770★ · 2021-07-15
- masahiro331/CVE-2020-82777★ · 2020-11-20
Exploit collections (1)
- CVE-2020-8277：Node.js通过DNS请求实现拒绝服务.mdtzwlhack/Vulnerability
Security advisories
- https://nodejs.org/en/blog/vulnerability/november-2020-security-releases
- https://hackerone.com/reports/1033107
- https://security.gentoo.org/glsa/202012-11
- https://security.gentoo.org/glsa/202101-07
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html