{"id":"CVE-2021-23386","aliases":["CLSA-2026-1780447839","EUVD-2021-0923","GHSA-3wcq-x3mq-6r9p","ROOT-APP-NPM-CVE-2021-23386"],"status":"published","title":"Remote Memory Exposure","description":"This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01425,"percentile":0.73317,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-908","CWE-909"],"published":"2021-05-20T16:15:18Z","modified":"2026-10-20T10:53:37Z","fixes":[{"ecosystem":"npm","package":"dns-packet","fixed_in":["1.3.2","5.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"dns-packet","fixed_in":["1.3.1-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"dns-packet","fixed_in":["1.3.1-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/dns-packet","fixed_in":["1.3.1-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"dns-packet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dns-packet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"5.2.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dns-packet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.1-tuxcare.0"},{"fixed":"1.3.1-tuxcare.1"}]}],"versions":["1.3.1"]},{"source":"osv","ecosystem":"npm","package":"dns-packet","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"5.2.2"}]}]},{"source":"osv","ecosystem":"npm","package":"dns-packet","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"dns-packet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/dns-packet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-root.io.1"}]}]}],"products":[{"vendor":"dns-packet_project","product":"dns-packet"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-DNSPACKET-1293563","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1295719","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://hackerone.com/bugs?subject=user\u0026amp%3Breport_id=968858","tags":["x_refsource_MISC","x_transferred","Permissions Required","Third Party Advisory","report","web"]},{"url":"https://github.com/mafintosh/dns-packet/commit/25f15dd0fedc53688b25fd053ebbdffe3d5c1c56","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23386","tags":["advisory"]},{"url":"https://github.com/mafintosh/dns-packet/commit/0d0d593f8df4e2712c43957a6c62e95047f12b2d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3wcq-x3mq-6r9p"}],"sources":{"cve":[{"id":"CVE-2021-23386","title":"Remote Memory Exposure","description":"This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.","status":"published","published":"2021-05-20T16:15:18.5Z","modified":"2024-09-16T20:52:54.669Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.488332Z"}],"euvd":[{"id":"EUVD-2021-0923","description":"This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.","status":"published","published":"2021-05-20T16:15:18Z","modified":"2024-09-16T20:52:54Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:55:10.024877Z"}],"ghsa":[{"id":"GHSA-3wcq-x3mq-6r9p","title":"Potential memory exposure in dns-packet","description":"This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.","status":"published","published":"2021-05-24T19:51:04Z","modified":"2025-02-12T05:11:11Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-200","CWE-908"],"updated_at":"2026-11-02T14:38:30.754382Z"}],"nvd":[{"id":"CVE-2021-23386","description":"This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.","status":"published","published":"2021-05-20T17:15:07.567Z","modified":"2026-06-17T03:38:40.063Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-909"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"CVE-2021-23386","description":"This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.","status":"published","published":"2021-05-20T17:15:07.567Z","modified":"2026-10-20T10:53:37.691961791Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"GHSA-3wcq-x3mq-6r9p","title":"Potential memory exposure in dns-packet","description":"This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.","status":"published","published":"2021-05-24T19:51:04Z","modified":"2025-01-14T08:56:52.881745Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-200","CWE-908"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"CLSA-2026-1780447839","title":"TuxCare security update for dns-packet (1 CVE)","description":"TuxCare rebuilt dns-packet to address 1 CVE. Fixed in 1.3.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.211413873Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"ROOT-APP-NPM-CVE-2021-23386","title":"CVE-2021-23386 in dns-packet - Patched by Root","description":"Root has patched CVE-2021-23386 in the dns-packet package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-03T03:03:32Z","modified":"2026-09-03T04:45:03.327865344Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}