{"action":"Upgrade netmask to 2.0.1 or later.","affected":[{"fixed":"2.0.1","introduced":"0"}],"component":"netmask","cve_ids":["CVE-2021-28918","CVE-2021-29418"],"ecosystem":"npm","epss":0.16657,"exploited":false,"fixed_versions":["2.0.1"],"ghsa_id":"GHSA-pch5-whg9-qr2r","id":"tcs_01M5KG3AMTMH4RFMT4HDNJV2M2","modified_at":"2026-09-10T03:49:14.440382329Z","published_at":"2021-03-29T21:32:05Z","references":["https://osv.dev/vulnerability/GHSA-pch5-whg9-qr2r","https://nvd.nist.gov/vuln/detail/CVE-2021-29418","https://github.com/rs/node-netmask/commit/3f19a056c4eb808ea4a29f234274c67bc5a848f4","https://security.netapp.com/advisory/ntap-20210604-0001","https://sick.codes/sick-2021-011","https://sick.codes/universal-netmask-npm-package-used-by-270000-projects-vulnerable-to-octal-input-data-server-side-request-forgery-remote-file-inclusion-local-file-inclusion-and-more-cve-2021-28918","https://vuln.ryotak.me/advisories/6","https://www.npmjs.com/package/netmask"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-pch5-whg9-qr2r","url":"https://osv.dev/vulnerability/GHSA-pch5-whg9-qr2r"}],"summary":"netmask npm package mishandles octal input data"}