Skip to content
Fencer Vulns
critical 9.1

CVE-2021-28918 in the critical feed json

Improper parsing of octal bytes in netmask

published 2021-03-29 5 y ago modified 2026-09-10 1 mo ago also CVE-2021-29418 , GHSA-4c7m-wxvm-r7gc , GHSA-pch5-whg9-qr2r , EUVD-2021-0754

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
15.0%
EPSS 15.0% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known, plus a Nuclei check

Summary

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

Patch / fix

  • npm netmask 1.1.0, 2.0.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-28918 updated cvss 9.1

nodejs-netmask: improper input validation of octal input data

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, rhacm2/mcm-topology-rhel8, rhacm2/application-ui-rhel8, rhacm2/console-header-rhel8
    affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

15.04% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Netmask NPM Package - Server-Side Request Forgery nuclei detection template
  • bleepingcomputer.com https://www.bleepingcomputer.com/news/security/critical-netmask-networking-bug-impacts-thousands-of-applications/ referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-011.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm netmask
<1.1.0
<2.0.1
1.1.0
2.0.1

Classification

Weakness
  • CWE-704 Incorrect Type Conversion or Cast
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.