Node.js: DNS rebinding in --inspect (insufficient fix of CVE-2018-7160)

Summary: While the debugger i.e., the --inspect option tries to prevent DNS rebinding, the whitelist is excessive. Description: The whitelist includes “localhost6”, which is not that widespread. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS...

PT-2021-2514

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 10.24.0 Node.js versions prior to 12.21.0 Node.js versions prior to 14.16.0 Node.js versions prior to 15.10.0 Description The issue is related to the presence of localhost6 in the whitelist, which can be exploited by ...