CVE-2021-22930
nodejs: Use-after-free on close http2 on stream canceling
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
Node.js versiones anteriores a 16.6.0, 14.17.4 y 12.22.4, es vulnerable a un ataque de uso de memoria previamente liberada donde un atacante podría aprovechar una corrupción de memoria para cambiar el comportamiento del proceso
A flaw was found in Node.js, where it is vulnerable to a use-after-free attack. This flaw allows an attacker to exploit the memory corruption, which causes a change in the process behavior. The highest threat from this vulnerability is to confidentiality and integrity.
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include denial of service, information leakage, out of bounds read, path sanitization, and use-after-free vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-06 CVE Reserved
- 2021-08-29 CVE Published
- 2024-08-03 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-416: Use After Free
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html | Mailing List |
|
| https://security.netapp.com/advisory/ntap-20211112-0002 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf | 2024-01-05 | |
| https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2 | 2024-01-05 |
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/202401-02 | 2024-01-05 | |
| https://access.redhat.com/security/cve/CVE-2021-22930 | 2021-09-27 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1988394 | 2021-09-27 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 12.0.0 < 12.22.4 Search vendor "Nodejs" for product "Node.js" and version " >= 12.0.0 < 12.22.4" | lts |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 14.0.0 < 14.17.4 Search vendor "Nodejs" for product "Node.js" and version " >= 14.0.0 < 14.17.4" | lts |
Affected
| ||||||
| Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 16.0.0 < 16.6.0 Search vendor "Nodejs" for product "Node.js" and version " >= 16.0.0 < 16.6.0" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Nextgen Api Search vendor "Netapp" for product "Nextgen Api" | - | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Sinec Infrastructure Network Services Search vendor "Siemens" for product "Sinec Infrastructure Network Services" | < 1.0.1.1 Search vendor "Siemens" for product "Sinec Infrastructure Network Services" and version " < 1.0.1.1" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||