Log in Start free

Vulnerability · Published Oct 7, 2021 · Assigned by hackerone

CVE-2021-22930

Critical 9.8

In plain English

A critical-severity use-after-free in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 36.5% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)36.5%top 1.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8nodejs1:12.22.5-1.module_el8.4.0+2529+af52a4c7ALSA-2021:3623
AlmaLinux:8nodejs1:12.22.5-1.module_el8.5.0+85+79a7b441ALSA-2021:3623
AlmaLinux:8nodejs-devel1:12.22.5-1.module_el8.5.0+85+79a7b441ALSA-2021:3623
AlmaLinux:8nodejs-devel1:12.22.5-1.module_el8.4.0+2529+af52a4c7ALSA-2021:3623
AlmaLinux:8nodejs-docs1:12.22.5-1.module_el8.4.0+2529+af52a4c7ALSA-2021:3623
AlmaLinux:8nodejs-full-i18n1:12.22.5-1.module_el8.5.0+85+79a7b441ALSA-2021:3623
AlmaLinux:8nodejs-full-i18n1:12.22.5-1.module_el8.4.0+2529+af52a4c7ALSA-2021:3623
AlmaLinux:8nodejs-nodemon2.0.3-1.module_el8.4.0+2521+c668cc9fALSA-2021:3623
AlmaLinux:8nodejs-nodemon2.0.3-1.module_el8.4.0+2521+c668cc9fALSA-2021:3666
AlmaLinux:8nodejs-packaging23-3.module_el8.4.0+2522+3bd42762ALSA-2021:3666
AlmaLinux:8nodejs-packaging17-3.module_el8.4.0+2224+b07ac28eALSA-2021:3623
AlmaLinux:8nodejs-packaging17-3.module_el8.4.0+2521+c668cc9fALSA-2021:3623
AlmaLinux:8nodejs-packaging17-3.module_el8.3.0+2023+d2377ea3ALSA-2021:3623
AlmaLinux:8nodejs-packaging23-3.module_el8.5.0+254+b4526b16ALSA-2021:3666
AlmaLinux:8npm1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7ALSA-2021:3623
AlmaLinux:8npm1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441ALSA-2021:3623
Alpine:v3.20nodejs14.17.4-r0ALPINE-CVE-2021-22930
Alpine:v3.21nodejs14.17.4-r0ALPINE-CVE-2021-22930
Alpine:v3.22nodejs14.17.4-r0ALPINE-CVE-2021-22930
Alpine:v3.23nodejs14.17.4-r0ALPINE-CVE-2021-22930
Alpine:v3.24nodejs14.17.4-r0ALPINE-CVE-2021-22930
Alpine:v3.20nodejs-current16.6.0-r0ALPINE-CVE-2021-22930
Alpine:v3.21nodejs-current16.6.0-r0ALPINE-CVE-2021-22930
Alpine:v3.22nodejs-current16.6.0-r0ALPINE-CVE-2021-22930
Alpine:v3.23nodejs-current16.6.0-r0ALPINE-CVE-2021-22930
Alpine:v3.24nodejs-current16.6.0-r0ALPINE-CVE-2021-22930
Debian:12nodejs12.22.4~dfsg-1DEBIAN-CVE-2021-22930
Debian:13nodejs12.22.4~dfsg-1DEBIAN-CVE-2021-22930
Debian:14nodejs12.22.4~dfsg-1DEBIAN-CVE-2021-22930
Rocky Linux:8nodejs1:12.22.5-1.module+el8.4.0+647+e905fa21RLSA-2021:3623
Rocky Linux:8nodejs1:14.17.5-1.module+el8.4.0+654+17ff1d38RLSA-2021:3666
Rocky Linux:8nodejs-nodemon0:2.0.3-1.module+el8.4.0+638+5344c6f7RLSA-2021:3623
Rocky Linux:8nodejs-nodemon0:2.0.3-1.module+el8.3.0+100+234774f7RLSA-2021:3666
Rocky Linux:8nodejs-nodemon0:2.0.3-1.module+el8.6.0+982+9fdca2d4RLSA-2021:3666
Rocky Linux:8nodejs-nodemon0:2.0.3-1.module+el8.4.0+638+5344c6f7RLSA-2021:3666
Rocky Linux:8nodejs-nodemon0:2.0.3-1.module+el8.3.0+100+234774f7RLSA-2021:3623
Rocky Linux:8nodejs-nodemon0:2.0.3-1.module+el8.6.0+982+9fdca2d4RLSA-2021:3623
Rocky Linux:8nodejs-packaging0:17-3.module+el8.3.0+101+f84c7154RLSA-2021:3623
Rocky Linux:8nodejs-packaging0:23-3.module+el8.5.0+733+de4fee6cRLSA-2021:3666
Rocky Linux:8nodejs-packaging0:23-3.module+el8.3.0+100+234774f7RLSA-2021:3666
Rocky Linux:8nodejs-packaging0:23-3.module+el8.7.0+1071+4bdda2a8RLSA-2021:3666

Affected products (as reported)

VendorProductVersions
NodeJS Node 4.0 – before 4.*5.0 – before 5.*6.0 – before 6.*7.0 – before 7.*8.0 – before 8.*9.0 – before 9.*10.0 – before 10.*11.0 – before 11.*

Weakness: CWE-416

References