Improper parsing of octal bytes in netmask

CRITICAL 9.1CVE-2021-28918 · CVE-2021-29418 · GHSA-4c7m-wxvm-r7gc · Published 01/04/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
netmask netmask_project	`≤ 1.0.6`	No fix yet
netmask npm	`< 1.1.0< 2.0.1`	`1.1.02.0.1`

Description

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

:exclamation: NOTE: The fix for this issue was incomplete. A subsequent fix was made in version 2.0.1 which was assigned CVE-2021-29418 / GHSA-pch5-whg9-qr2r. For complete protection from this vulnerability an upgrade to version 2.0.1 or later is recommended.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2021-28918 · ADVISORY
GitHub Advisory GHSA-pch5-whg9-qr2r · ADVISORY
rs/node-netmask · WEB
rs/node-netmask · WEB
sickcodes/security · WEB
rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects · WEB
security.netapp.com/advisory/ntap-20210528-0010 · WEB
bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications · WEB
npmjs.com/package/netmask · WEB
rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects · Third Party Advisory
security.netapp.com/advisory/ntap-20210528-0010 · Third Party Advisory
bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications · Exploit
nvd.nist.gov/vuln/detail/CVE-2021-29418 · ADVISORY
rs/node-netmask commit 3f19a05 · WEB
security.netapp.com/advisory/ntap-20210604-0001 · WEB
sick.codes/sick-2021-011 · WEB
sick.codes/universal-netmask-npm-package-used-by-270000-projects-vulnerable-to-octal-input-data-server-side-request-forgery-remote-file-inclusion-local-file-inclusion-and-more-cve-2021-28918 · WEB
vuln.ryotak.me/advisories/6 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free