CVE-2020-8277
HighA Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses.
Published May 3, 2021 · Updated Sep 8, 2026 · Also known as ALPINE-CVE-2020-8277, BIT-node-2020-8277, BIT-node-min-2020-8277, DEBIAN-CVE-2020-8277, SUSE-SU-2020:3478-1, SUSE-SU-2020:3549-1
Key Facts
Patch immediately- CVE-2020-8277 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting C-Ares (C-Ares Project), Node.js (Nodejs), Blockchain Platform (Oracle) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 54% probability of exploitation in the next 30 days.
- Fixed versions are available, including C-Ares 1.16.1, C-Ares 1.16.1-1.ph1, C-Ares 1.16.1-1.ph2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
54%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2020-8277 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
Affected Products
141 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| C-AresC-Ares Project | See advisory | 1.16.0 |
| Node.jsNodejs | See advisory | 15.2.1 |
| Blockchain PlatformOracle | See advisory | 21.1.2 |
| GraalvmOracle | 19.3.4, 20.3.0 | n/a |
| Jd Edwards Enterpriseone ToolsOracle | See advisory | 9.2.6.0 |
Patched Releases
C-Ares
1.16.1, 1.16.1-1.ph1, 1.16.1-1.ph2, 1.16.1-1.ph3, 1.16.1-2.ph4, 1.17.0-3.8.1, 1.17.1-1, 1.16.0
c-ares-devel
1.16.1-2.ph4, 1.17.0-3.8.1, 1.17.0-lp151.3.6.1, 1.17.0-lp152.2.3.1, 1.17.2-2.2
c-ares-utils
1.17.0-lp151.3.6.1, 1.17.0-lp152.2.3.1, 1.17.2-2.2
libcares2
1.17.0-3.8.1, 1.17.0-lp151.3.6.1, 1.17.0-lp152.2.3.1, 1.17.2-2.2
libcares2-32bit
1.17.0-lp151.3.6.1, 1.17.0-lp152.2.3.1, 1.17.2-2.2
Node
12.19.1, 14.15.1, 15.2.1, 11.*, 13.*, 4.*, 5.*, 6.*, 7.*, 8.*, 9.*
node-min
12.19.1, 14.15.1, 15.2.1
nodejs
1:12.19.1-1.module+el8.3.0+7884+668e4ef8, 1:14.15.4-2.module+el8.3.0+9657+a08a905a, 12.20.1-r0, 14.15.1-r0, 14.16.0-1.ph4
Node.js
12.19.1, 15.2.1
nodejs-current
15.3.0-r0
nodejs-devel
1:12.19.1-1.module+el8.3.0+7884+668e4ef8, 1:14.15.4-2.module+el8.3.0+9657+a08a905a, 14.16.0-1.ph4
nodejs-docs
1:12.19.1-1.module+el8.3.0+7884+668e4ef8, 1:14.15.4-2.module+el8.3.0+9657+a08a905a
nodejs-full-i18n
1:12.19.1-1.module+el8.3.0+7884+668e4ef8, 1:14.15.4-2.module+el8.3.0+9657+a08a905a
nodejs-nodemon
1.18.3-1.module_el8.3.0+2023+d2377ea3, 1.18.3-1.module+el8.1.0+5393+aaf413e3, 1.18.3-1.module+el8.3.0+101+f84c7154, 2.0.3-1.module_el8.4.0+2521+c668cc9f, 2.0.3-1.module+el8.3.0+7818+6cd30d85, 2.0.3-1.module+el8.6.0+982+9fdca2d4
nodejs-packaging
17-3.module_el8.4.0+2224+b07ac28e, 17-3.module+el8.1.0+5393+aaf413e3, 17-3.module+el8.3.0+101+f84c7154, 23-3.module_el8.5.0+254+b4526b16, 23-3.module+el8.3.0+7818+6cd30d85, 23-3.module+el8.7.0+1071+4bdda2a8
nodejs:12
8030020201124152102.229f0a1c
nodejs:14
8030020210126165503.229f0a1c
nodejs12
12.19.1-1.23.1, 12.20.1-4.10.1, 12.20.1-lp152.3.9.1
nodejs12-devel
12.19.1-1.23.1, 12.20.1-4.10.1, 12.20.1-lp152.3.9.1
nodejs12-docs
12.19.1-1.23.1, 12.20.1-4.10.1, 12.20.1-lp152.3.9.1
nodejs14
14.15.4-5.6.1, 14.15.4-lp152.5.1, 14.17.5-1.2
nodejs14-devel
14.15.4-5.6.1, 14.15.4-lp152.5.1, 14.17.5-1.2
nodejs14-docs
14.15.4-5.6.1, 14.15.4-lp152.5.1, 14.17.5-1.2
npm
1:6.14.10-1.14.15.4.2.module+el8.3.0+9657+a08a905a, 1:6.14.8-1.12.19.1.1.module+el8.3.0+7884+668e4ef8
npm12
12.19.1-1.23.1, 12.20.1-4.10.1, 12.20.1-lp152.3.9.1
Timeline
Publicly disclosed
May 3, 2021
Last updated
Sep 8, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-400 Uncontrolled Resource Consumption
References
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8277
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8623
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8624
- advisoryRHSA-2020:5305
- advisoryRHSA-2020:5499
FAQ
Common Questions.
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses.
Affected: C-Ares (C-Ares Project); Node.js (Nodejs); Blockchain Platform (Oracle), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including C-Ares 1.16.1, C-Ares 1.16.1-1.ph1, C-Ares 1.16.1-1.ph2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-8277 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo