# CVE-2018-7160: Node.js 6: Reliance on Reverse DNS Resolution for a Security-Critical Action

CVE-2018-7160 is fixed in 2 products on 2 platforms, first by Node.js 6 6.17.0, released February 28, 2019. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2018-7160
- Priority: High
- CVSS: 8.8 (Medium)
- EPSS: 0.0949
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 17, 2018
- Weakness: CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2018-7160

## Description

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 6 | 6.17.0 | [Node.js 6 6.17.0](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.6-6.17.0.md) | Feb 28, 2019 |
| Linux | nodejs Ubuntu 18.04.6 LTS (bionic) | 8.10.0~dfsg-2ubuntu0.4+esm1 | [nodejs 8.10.0~dfsg-2ubuntu0.4+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-nodejs-8.10.0-dfsg-2ubuntu0.4-esm1.md) | Mar 28, 2019 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.