npm/netmask CVE-2021-28918, CVE-2021-29418: critical 9.1, EPSS 15.04%

Improper parsing of octal bytes in netmask

Action: Upgrade netmask to 1.1.0 or later.

npm i netmask@1.1.0

Affected

Fixed versions

Sources

• osv: GHSA-4c7m-wxvm-r7gc
• https://nvd.nist.gov/vuln/detail/CVE-2021-28918
• https://github.com/advisories/GHSA-pch5-whg9-qr2r
• https://github.com/rs/node-netmask
• https://github.com/rs/node-netmask/blob/98294cb20695f2c6c36219a4fbcd4744fb8d0682/CHANGELOG.md#v110-mar-18-2021
• https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md
• https://rootdaemon.com/2021/03/29/vulnerability-in-netmask-npm-package-affects-280000-projects
• https://security.netapp.com/advisory/ntap-20210528-0010
• https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications
• https://www.npmjs.com/package/netmask

CVE-2021-28918, CVE-2021-29418 · published 2021-04-14T15:03:16Z · modified 2026-09-10T03:49:26.521770326Z · JSON