CVE-2021-28918

CVE-2021-28918 affects the Node.js netmask module (v1.0.6 and earlier). The vulnerability is due to improper handling of mixed-format IP addresses, allowing a remote attacker to perform SSRF, RFI, and LFI via specially crafted octal literals and reach internal VPNs, LANs, intranets, or adjacent h...

CVE-2021-29418

CVE-2021-29418 affects the Node.js netmask module, where the library mishandles certain unexpected characters in IP address strings (e.g., octal digit 9). This can allow a remote attacker to bypass access control based on IP addresses. The issue arises from an incomplete fix for CVE-2021-28918. A...