CVE

CVE-2021-28918

9.1

CVSS

Description

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

Attack Vector

Privileges Req.

User Interaction

Updated Oct 24, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2021-28918 Scanner

CVE-2021-28918 scanner - Server-Side-Request-Forgery (SSRF) vulnerability in Netmask Npm Package

Used 2.3k times · 3.4k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →