CVE-2021-29418 - CVE House
Back to Database
Status published Medium CVE-2021-29418

The netmask package before 2.0.1 for Node.js mishandles certain unexpected...

Vulnerability Description

The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-29418

Credits & Attribution

No credits recorded in the NVD database.

References

More from netmask project

View All →
CVE-2021-28918
Improper input validation of octal strings in netmask npm package...
Critical 9.1

Affected Vendor

netmask project

View all reports →

Affected Software

netmask
Vulnerable Versions:
0

Timeline

Official Publish: March 30th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.