ROOT-APP-NPM-CVE-2021-23386 CVE-2021-23386 in dns-packet - Patched by Root

Root has patched CVE-2021-23386 in the dns-packet package for Root:npm. Multiple fixed versions available...

@anothersoftware/lotion-connect (>=0.1.23, <=0.1.24), @beaker/core (>=1.0.0, <=3.0.2) +372 more potentially affected by CVE-2021-23386 via dns-packet (>=3.0.1, <=5.2.1)

dns-packet NPM version =3.0.1, =0.1.23, =1.0.0, =1.0.0, =1.2.2-urlencoded, =2.0.6, =2.0.2, =0.0.1, =1.0.0, =1.0.1, =1.0.0, =0.0.1, =1.0.1, =1.0.1, =2.0.0, =2.2.0 and more Source cves: CVE-2021-23386 Source advisory: OSV:GHSA-3WCQ-X3MQ-6R9P...

aloha-sd (>=1.0.0, <=1.0.7) potentially affected by CVE-2021-23386 via dns-packet (1.1.1)

dns-packet NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dns-packet and may be impacted: - aloha-sd =1.0.0, =1.0.7 Source cves: CVE-2021-23386 Source advisory: OSV:GHSA-3WCQ-X3MQ-6R9P...

CVE-2021-23386

Remote memory exposure vulnerability was found in nodejs dns-packet library. The buffers created with allocUnsafe are not always filled before forming the network packets and an attacker can use this vulnerability to potentially get access to internal application memory over non encrypted network...

CVE-2021-23386

This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names...

CVE-2021-23386

The CVE-2021-23386 vulnerability affects dns-packet prior to 5.2.2. It creates buffers with allocUnsafe and may not fill them before forming network packets, potentially exposing internal memory over unencrypted networks when querying crafted invalid domain names. The issue is documented in the c...

aloha-sd (>=1.0.0, <=1.0.7) potentially affected by CVE-2021-23386 via dns-packet (1.1.1)

dns-packet NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dns-packet and may be impacted: - aloha-sd =1.0.0, =1.0.7 Source cves: CVE-2021-23386 Source advisory: SNYK:JS-DNSPACKET-1293563...

@anothersoftware/lotion-connect (>=0.1.23, <=0.1.24), @beaker/core (>=1.0.0, <=3.0.2) +372 more potentially affected by CVE-2021-23386 via dns-packet (>=3.0.1, <=5.2.1)

dns-packet NPM version =3.0.1, =0.1.23, =1.0.0, =1.0.0, =1.2.2-urlencoded, =2.0.6, =2.0.2, =0.0.1, =1.0.0, =1.0.1, =1.0.0, =0.0.1, =1.0.1, =1.0.1, =2.0.0, =2.2.0 and more Source cves: CVE-2021-23386 Source advisory: SNYK:JS-DNSPACKET-1293563...