CVE-2017-1000381

What it actually does

The ares_parse_naptr_reply function in c-ares performs an out-of-bounds memory read when parsing a specially crafted NAPTR DNS response packet, exposing adjacent heap memory contents.

Why it matters to the business

Attackers may obtain fragments of sensitive data such as cryptographic material, configuration strings, or user information from the process memory of affected Node.js applications.

How an attack unfolds

An attacker controlling a DNS server or positioned to inject responses sends a malformed NAPTR record that triggers the vulnerable parser path, causing the library to read beyond the supplied buffer and return the leaked bytes to the calling application.

How to fix it

Upgrade the Node.js installation to a build that includes commit 03a2f0c462aedcf4aaaa077c6b79791faa36bce0 or later; rebuild any statically linked c-ares libraries and restart services.

How to confirm the fix worked

Confirm the running Node.js binary links against a c-ares library containing commit 03a2f0c or verify the source tree contains the referenced commit; re-test with a fuzzed NAPTR packet to ensure no out-of-bounds access occurs.

Typical attack path

1. Identify a Node.js application that performs DNS resolution using the vulnerable c-ares build.
2. Craft and serve a malicious NAPTR DNS response containing an oversized or malformed record.
3. Trigger the resolution operation so the crafted packet reaches ares_parse_naptr_reply.
4. Capture the excess memory bytes returned in the parsed reply structure.

How to detect it

Search DNS resolver logs and application debug output for unusually large or malformed NAPTR replies; correlate with process crashes or memory dumps containing unexpected binary fragments after DNS operations.

What your security team should do

• Prioritize patching all Node.js instances that perform DNS lookups to the fixed commit.
• Review and restrict outbound DNS traffic where possible to reduce exposure surface.
• Add the fixed commit hash to dependency scanners and CI pipelines to prevent regression.