CVE-2021-29418

Published: Mar 30, 2021Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.

Affected (1)

Products: Netmask Project: Netmask

Netmask Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Netmask Project Netmask	Before 2.0.1

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (6)

https://github.com/rs/node-netmask/commit/3f19a056c4eb808ea4a29f234274c67bc5a848f4

Source: cve@mitre.org

PatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20210604-0001/

Source: cve@mitre.org

Third Party Advisory

https://vuln.ryotak.me/advisories/6

Source: cve@mitre.org

Third Party Advisory

https://github.com/rs/node-netmask/commit/3f19a056c4eb808ea4a29f234274c67bc5a848f4

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20210604-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://vuln.ryotak.me/advisories/6

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.