Description
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Netmask NPM Package - Server-Side Request Forgery http/cves/2021/CVE-2021-28918.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | netmask | < 1.1.0 | 1.1.0 | GHSA-4c7m-wxvm-r7gc |
| npm | netmask | < 2.0.1 | 2.0.1 | GHSA-pch5-whg9-qr2r |
Advisories 1
- WID-SEC-2022-1354 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 3, 2026
References
- https://www.npmjs.com/package/netmask
- https://github.com/rs/node-netmask
- https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/
- https://github.com/advisories/GHSA-pch5-whg9-qr2r
- https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
- https://security.netapp.com/advisory/ntap-20210528-0010/
- https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects/