Vulnerability record · CVE-2020-8277 · published 19 November 2020
CVE-2020-8277: Node.js DNS resolution flaw enables denial of service
Nodejs · Node.Js
Node.js versions before 15.2.1, 14.15.1, and 12.19.1 can be driven into a denial of service when an application resolves a DNS record that returns a large number of responses. The flaw is uncontrolled resource consumption (CWE-400) in the DNS resolution path, and it matters because any application that resolves attacker-influenced hostnames can be knocked over without authentication.
Description
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityCVSS 7.5 with network reachability, no authentication, and high EPSS make this a realistic availability threat, though it is not known to be actively exploited.
What it is
Node.js versions before 15.2.1, 14.15.1, and 12.19.1 can be driven into a denial of service when an application resolves a DNS record that returns a large number of responses. The flaw is uncontrolled resource consumption (CWE-400) in the DNS resolution path, and it matters because any application that resolves attacker-influenced hostnames can be knocked over without authentication.
Impact
An attacker can exhaust resources and cause the Node.js process or service to become unavailable. There is no confidentiality or integrity impact; the effect is availability loss.
Attack surface
Reached over the network (AV:N) with no privileges and no user interaction required, per the CVSS vector. The attacker only needs to control or influence a hostname that the application resolves via DNS.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented. EPSS is high (0.54164, ~98.96th percentile), and references include a HackerOne report plus vendor patch advisories, indicating public technical detail exists.
What to do
- Upgrade Node.js to 15.2.1, 14.15.1, or 12.19.1 or later; these are the fixed versions named in the advisory.
- Apply vendor patches for downstream products that bundle the affected c-ares/Node.js code, including Oracle and Fedora packages.
- Restrict or validate hostnames that applications are allowed to resolve, so untrusted input cannot drive DNS lookups.
- Add resource limits and monitoring around DNS resolution in Node.js services to contain runaway response processing.
Detection
- Monitor Node.js processes for abnormal memory or CPU growth correlated with DNS resolution activity.
- Alert on DNS responses containing unusually large numbers of records returned to application resolvers.
- Log and review application inputs that control hostnames passed to DNS resolution functions.
- Track service availability drops or restarts in Node.js workloads that perform outbound DNS lookups.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-8277 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-8277), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
