Wiz
Vulnerability DatabaseCVE-2021-22931

CVE-2021-22931: 
npm vulnerability analysis and mitigation

Overview

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library (Node.js Blog).

Technical details

The vulnerability exists in the Node.js DNS library due to missing input validation of hostnames returned by Domain Name Servers. This can result in multiple security issues including Remote Code Execution (RCE), Cross-Site Scripting (XSS), and application crashes. The vulnerability has a CVSS v3.1 Base Score of 9.8 CRITICAL with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

Impact

Successful exploitation of this vulnerability could lead to Remote Code Execution, Cross-Site Scripting attacks, application crashes, output of wrong hostnames leading to Domain Hijacking, and injection vulnerabilities in applications using the affected library (Node.js Blog).

Mitigation and workarounds

Users should upgrade to Node.js versions 16.6.0, 14.17.4, or 12.22.4 or later which contain fixes for this vulnerability (Node.js Blog).

Additional resources

Source: This report was generated using AI

Related npm vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2025-64756HIGH7.5
  • JavaScriptJavaScript
  • nodejs:22::npm
NoYesNov 17, 2025
CVE-2025-6965HIGH7.2
  • SQLiteSQLite
  • rust-toolset-srpm-macros
NoYesJul 15, 2025
CVE-2025-7458MEDIUM6.9
  • SQLiteSQLite
  • rust-toolset:rhel8::rust-gdb
NoYesJul 29, 2025
CVE-2025-64118MEDIUM6.1
  • JavaScriptJavaScript
  • renovate
NoYesOct 30, 2025
CVE-2025-52099N/AN/A
  • SQLiteSQLite
  • seal-sqlite
NoYesOct 24, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo