CVE-2021-28918
Improper parsing of octal bytes in netmask
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
- Record
CVE-2021-28918- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-704
- Updated
- 2026-11-02
CVE List No score
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
- Record
CVE-2021-28918- Updated
- 2026-11-02
EUVDEUVD-2021-0754 No score
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
- Record
EUVD-2021-0754- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4c7m-wxvm-r7gc
Improper parsing of octal bytes in netmask
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
:exclamation: NOTE: The fix for this issue was incomplete. A subsequent fix was made in version 2.0.1 which was assigned CVE-2021-29418 / GHSA-pch5-whg9-qr2r. For complete protection from this vulnerability an upgrade to version 2.0.1 or later is recommended.
- Record
GHSA-4c7m-wxvm-r7gc- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
- Record
CVE-2021-28918- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCVE-2021-29418
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
- Record
CVE-2021-29418- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-4c7m-wxvm-r7gc
Improper parsing of octal bytes in netmask
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
:exclamation: NOTE: The fix for this issue was incomplete. A subsequent fix was made in version 2.0.1 which was assigned CVE-2021-29418 / GHSA-pch5-whg9-qr2r. For complete protection from this vulnerability an upgrade to version 2.0.1 or later is recommended.
- Record
GHSA-4c7m-wxvm-r7gc- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-pch5-whg9-qr2r
netmask npm package mishandles octal input data
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
- Record
GHSA-pch5-whg9-qr2r- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2021-28918
CVE-2021-28918 in netmask - Patched by Root
Root has patched CVE-2021-28918 in the netmask package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2021-28918- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-06
OSVCLSA-2026-1776904637 No score
TuxCare security update for netmask (2 CVEs)
TuxCare rebuilt netmask to address 2 CVEs. Fixed in 1.0.6-tuxcare.1.
- Record
CLSA-2026-1776904637- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
netmasknpm |
before 1.1.0 | 1.1.0 |
netmaskTuxCare:npm From an advisory covering 2 CVEs |
1.0.6-tuxcare.0 up to 1.0.6-tuxcare.1, plus listed versions 1.0.6 |
1.0.6-tuxcare.1 |
netmasknpm From an advisory covering 2 CVEs |
before 1.1.0 | 1.1.0 |
netmasknpm From an advisory covering 2 CVEs |
before 2.0.1 | 2.0.1 |
netmaskRoot:npm |
before 1.0.6-aikido.1 | 1.0.6-aikido.1 |
@rootio/netmaskRoot:npm |
before 1.0.6-root.io.1 | 1.0.6-root.io.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Netmask NPM Package - Server-Side Request Forgery |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-28918 is a critical vulnerability (CVSS 9.1) in Netmask Project Netmask, published March 29, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 15.0%, the 96th percentile. Fixed in netmask 1.1.0.
References
npmjs.com/package/netmask
github.com/rs/node-netmask
bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications
security.netapp.com/advisory/ntap-20210528-0010
Show 10 moreShow less
rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects
nvd.nist.gov/vuln/detail/CVE-2021-28918
vuln.ryotak.me/advisories/6
sick.codes/sick-2021-011