CVE-2021-22884: 
npm vulnerability analysis and mitigation

Node.js versions prior to 10.24.0, 12.21.0, 14.16.0, and 15.10.0 are vulnerable to DNS rebinding attacks when the whitelist includes "localhost6". When "localhost6" is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the "localhost6" domain. As long as the attacker uses the "localhost6" domain, they can still apply the attack described in CVE-2018-7160. The vulnerability was discovered and disclosed in February 2021 (NodeJS Blog).

The vulnerability exists in Node.js's --inspect functionality, which is used for debugging. The DNS rebinding protection mechanism can be bypassed when "localhost6" is included in the whitelist. Since "localhost6" may not be defined in /etc/hosts, it gets resolved through DNS over the network. This allows an attacker who can control or spoof DNS responses to bypass the DNS rebinding protection by using the "localhost6" domain (NodeJS Blog).

If successfully exploited, this vulnerability could allow an attacker to perform remote code execution through DNS rebinding attacks. The attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process with debug port active (NodeJS Blog).

The vulnerability requires the attacker to control the victim's DNS server or have the ability to spoof DNS responses. The attack also requires that the Node.js process is running with the --inspect debugging option enabled and "localhost6" is included in the whitelist (NodeJS Blog).

The vulnerability has been fixed in Node.js versions 10.24.0, 12.21.0, 14.16.0, and 15.10.0. Users should upgrade to these or later versions. For environments where immediate upgrading is not possible, users should avoid using the --inspect debugging option or ensure "localhost6" is properly configured in /etc/hosts (NodeJS Blog).

The vulnerability was reported by Vít Šesták and was assigned a High severity rating. Multiple organizations including Red Hat, Fedora, and NetApp issued security advisories for their products that incorporate Node.js (Red Hat, NetApp).