Vulnerability · Published Mar 3, 2021 · Assigned by hackerone

CVE-2021-22883

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 77.4% (higher than 99.6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)77.4%top 0.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	nodejs	1:10.24.0-1.module_el8.5.0+81+7dbe79d3	ALSA-2021:0735
AlmaLinux:8	nodejs	1:10.24.0-1.module_el8.4.0+2224+b07ac28e	ALSA-2021:0735
AlmaLinux:8	nodejs	1:10.24.0-1.module_el8.3.0+2047+b07ac28e	ALSA-2021:0735
AlmaLinux:8	nodejs-devel	1:10.24.0-1.module_el8.5.0+81+7dbe79d3	ALSA-2021:0735
AlmaLinux:8	nodejs-devel	1:10.24.0-1.module_el8.4.0+2224+b07ac28e	ALSA-2021:0735
AlmaLinux:8	nodejs-devel	1:10.24.0-1.module_el8.3.0+2047+b07ac28e	ALSA-2021:0735
AlmaLinux:8	nodejs-docs	1:10.24.0-1.module_el8.3.0+2047+b07ac28e	ALSA-2021:0735
AlmaLinux:8	nodejs-full-i18n	1:10.24.0-1.module_el8.4.0+2224+b07ac28e	ALSA-2021:0735
AlmaLinux:8	nodejs-full-i18n	1:10.24.0-1.module_el8.5.0+81+7dbe79d3	ALSA-2021:0735
AlmaLinux:8	nodejs-full-i18n	1:10.24.0-1.module_el8.3.0+2047+b07ac28e	ALSA-2021:0735
AlmaLinux:8	nodejs-nodemon	2.0.3-1.module_el8.4.0+2521+c668cc9f	ALSA-2021:0734
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2023+d2377ea3	ALSA-2021:0735
AlmaLinux:8	nodejs-nodemon	1.18.3-1.module_el8.3.0+2047+b07ac28e	ALSA-2021:0735
AlmaLinux:8	nodejs-nodemon	2.0.3-1.module_el8.4.0+2521+c668cc9f	ALSA-2021:0744
AlmaLinux:8	nodejs-packaging	23-3.module_el8.4.0+2522+3bd42762	ALSA-2021:0744
AlmaLinux:8	nodejs-packaging	23-3.module_el8.5.0+254+b4526b16	ALSA-2021:0744
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2224+b07ac28e	ALSA-2021:0735
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2521+c668cc9f	ALSA-2021:0735
AlmaLinux:8	nodejs-packaging	17-3.module_el8.3.0+2023+d2377ea3	ALSA-2021:0735
AlmaLinux:8	nodejs-packaging	17-3.module_el8.3.0+2023+d2377ea3	ALSA-2021:0734
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2521+c668cc9f	ALSA-2021:0734
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2224+b07ac28e	ALSA-2021:0734
AlmaLinux:8	npm	1:6.14.11-1.10.24.0.1.module_el8.5.0+81+7dbe79d3	ALSA-2021:0735
AlmaLinux:8	npm	1:6.14.11-1.10.24.0.1.module_el8.3.0+2047+b07ac28e	ALSA-2021:0735
AlmaLinux:8	npm	1:6.14.11-1.10.24.0.1.module_el8.4.0+2224+b07ac28e	ALSA-2021:0735
Alpine:v3.20	nodejs	14.16.0-r0	ALPINE-CVE-2021-22883
Alpine:v3.21	nodejs	14.16.0-r0	ALPINE-CVE-2021-22883
Alpine:v3.22	nodejs	14.16.0-r0	ALPINE-CVE-2021-22883
Alpine:v3.23	nodejs	14.16.0-r0	ALPINE-CVE-2021-22883
Alpine:v3.24	nodejs	14.16.0-r0	ALPINE-CVE-2021-22883
Alpine:v3.20	nodejs-current	15.10.0-r0	ALPINE-CVE-2021-22883
Alpine:v3.21	nodejs-current	15.10.0-r0	ALPINE-CVE-2021-22883
Alpine:v3.22	nodejs-current	15.10.0-r0	ALPINE-CVE-2021-22883
Alpine:v3.23	nodejs-current	15.10.0-r0	ALPINE-CVE-2021-22883
Alpine:v3.24	nodejs-current	15.10.0-r0	ALPINE-CVE-2021-22883
Debian:12	nodejs	12.21.0~dfsg-1	DEBIAN-CVE-2021-22883
Debian:13	nodejs	12.21.0~dfsg-1	DEBIAN-CVE-2021-22883
Debian:14	nodejs	12.21.0~dfsg-1	DEBIAN-CVE-2021-22883
Rocky Linux:8	nodejs	1:10.24.0-1.module+el8.3.0+101+f84c7154	RLSA-2021:0735
Rocky Linux:8	nodejs	1:12.21.0-1.module+el8.3.0+99+3663d81c	RLSA-2021:0734
Rocky Linux:8	nodejs	1:14.16.0-2.module+el8.3.0+100+234774f7	RLSA-2021:0744
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.6.0+982+9fdca2d4	RLSA-2021:0734
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.6.0+982+9fdca2d4	RLSA-2021:0744
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.3.0+100+234774f7	RLSA-2021:0744
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.4.0+638+5344c6f7	RLSA-2021:0744
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.4.0+638+5344c6f7	RLSA-2021:0734
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.3.0+100+234774f7	RLSA-2021:0734
Rocky Linux:8	nodejs-nodemon	0:1.18.3-1.module+el8.3.0+101+f84c7154	RLSA-2021:0735
Rocky Linux:8	nodejs-packaging	0:17-3.module+el8.3.0+101+f84c7154	RLSA-2021:0735
Rocky Linux:8	nodejs-packaging	0:17-3.module+el8.3.0+101+f84c7154	RLSA-2021:0734
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.5.0+733+de4fee6c	RLSA-2021:0744
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.3.0+100+234774f7	RLSA-2021:0744
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.7.0+1071+4bdda2a8	RLSA-2021:0744

Affected products (as reported)

Vendor	Product	Versions
NodeJS	Node	4.0 – before 4.5.0 – before 5.6.0 – before 6.7.0 – before 7.8.0 – before 8.9.0 – before 9.10.0 – before 10.24.011.0 – before 11.*

Weakness: CWE-400

References

https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/ x_refsource_MISC
https://hackerone.com/reports/1043360 x_refsource_MISC
FEDORA-2021-a760169c3c vendor-advisory, x_refsource_FEDORA
FEDORA-2021-f6bd75e9d4 vendor-advisory, x_refsource_FEDORA
FEDORA-2021-6aaba80ba2 vendor-advisory, x_refsource_FEDORA
https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210416-0001/ x_refsource_CONFIRM
https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf x_refsource_CONFIRM