Vulnerability · Published Aug 16, 2021 · Assigned by hackerone
CVE-2021-22940
High 7.5
In plain English
A high-severity use-after-free in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 13.9% (higher than 97% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)13.9%top 3.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 | ALSA-2021:3623 |
| AlmaLinux:8 | nodejs | 1:12.22.5-1.module_el8.5.0+85+79a7b441 | ALSA-2021:3623 |
| AlmaLinux:8 | nodejs-devel | 1:12.22.5-1.module_el8.5.0+85+79a7b441 | ALSA-2021:3623 |
| AlmaLinux:8 | nodejs-devel | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 | ALSA-2021:3623 |
| AlmaLinux:8 | nodejs-docs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 | ALSA-2021:3623 |
| AlmaLinux:8 | nodejs-full-i18n | 1:12.22.5-1.module_el8.5.0+85+79a7b441 | ALSA-2021:3623 |
| AlmaLinux:8 | nodejs-full-i18n | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 | ALSA-2021:3623 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f | ALSA-2021:3623 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f | ALSA-2021:3666 |
| AlmaLinux:8 | nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 | ALSA-2021:3666 |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e | ALSA-2021:3623 |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f | ALSA-2021:3623 |
| AlmaLinux:8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2021:3623 |
| AlmaLinux:8 | nodejs-packaging | 23-3.module_el8.5.0+254+b4526b16 | ALSA-2021:3666 |
| AlmaLinux:8 | npm | 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7 | ALSA-2021:3623 |
| AlmaLinux:8 | npm | 1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441 | ALSA-2021:3623 |
| Debian:12 | nodejs | 12.22.5~dfsg-1 | DEBIAN-CVE-2021-22940 |
| Debian:13 | nodejs | 12.22.5~dfsg-1 | DEBIAN-CVE-2021-22940 |
| Debian:14 | nodejs | 12.22.5~dfsg-1 | DEBIAN-CVE-2021-22940 |
| Rocky Linux:8 | nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 | RLSA-2021:3623 |
| Rocky Linux:8 | nodejs | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 | RLSA-2021:3666 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.3-1.module+el8.4.0+638+5344c6f7 | RLSA-2021:3666 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.3-1.module+el8.4.0+638+5344c6f7 | RLSA-2021:3623 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.3-1.module+el8.3.0+100+234774f7 | RLSA-2021:3623 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.3-1.module+el8.6.0+982+9fdca2d4 | RLSA-2021:3623 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.3-1.module+el8.6.0+982+9fdca2d4 | RLSA-2021:3666 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.3-1.module+el8.3.0+100+234774f7 | RLSA-2021:3666 |
| Rocky Linux:8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 | RLSA-2021:3623 |
| Rocky Linux:8 | nodejs-packaging | 0:23-3.module+el8.7.0+1071+4bdda2a8 | RLSA-2021:3666 |
| Rocky Linux:8 | nodejs-packaging | 0:23-3.module+el8.3.0+100+234774f7 | RLSA-2021:3666 |
| Rocky Linux:8 | nodejs-packaging | 0:23-3.module+el8.5.0+733+de4fee6c | RLSA-2021:3666 |
| Ubuntu:22.04:LTS | nodejs | 12.22.9~dfsg-1ubuntu3.6 | UBUNTU-CVE-2021-22940 |
Affected products (as reported)
Weakness: CWE-416
References
- https://hackerone.com/reports/1238162
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210923-0001/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://www.oracle.com/security-alerts/cpujul2022.html
- [debian-lts-announce] 20221005 [SECURITY] [DLA 3137-1] nodejs security update mailing-list
- GLSA-202401-02 vendor-advisory