Description
This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.
Recommendation
Update the dns-packet package to the latest compatible version. Followings are version details:
Affected version(s): **>= 2.0.0, < 5.2.2 < 1.3.2** Patched version(s): **5.2.2 1.3.2**
References
Could your website be exposed too?
SmartScanner can check your website for Potential memory exposure in dns-packet and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Exposure of Sensitive Information to an Unauthorized Actor in nanoid - CVE-2021-23566
- [thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values - CVE-2021-21412
- Basic-auth app bundle credential exposure in gatsby-source-wordpress - CVE-2021-32770
- Potential exposure of tokens to an Unauthorized Actor - CVE-2022-21671
You might also like:
See something that needs correcting? Let us knowUpdated February 12, 2025