CVE-2021-22930

Source
https://cve.org/CVERecord?id=CVE-2021-22930
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-22930.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-22930
Aliases
Downstream
ALPINE (1)
ALSA (2)
AZL (1)
BELL (1)
CLEANSTART (16)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (10)
RHSA (6)
RLSA (2)
SUSE (9)
UBUNTU (1)
Related
Published
2021-10-07T14:15:08Z
Modified
2026-10-24T10:33:33Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Database specific
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "1.0.1.1"
                        }
                    ],
                    "source": "CPE_RANGE"
                }
            ],
            "vendor_product": "siemens:sinec_infrastructure_network_services"
        },
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "10.0"
                        },
                        {
                            "last_affected": "10.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "debian:debian_linux"
        }
    ]
}
References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/node
Events
Database specific
Show details
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
            "range": [
                {
                    "introduced": "12.0.0"
                },
                {
                    "fixed": "12.22.4"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
            "range": [
                {
                    "introduced": "14.0.0"
                },
                {
                    "fixed": "14.17.4"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
            "range": [
                {
                    "introduced": "16.0.0"
                },
                {
                    "fixed": "16.6.0"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v12.*
v12.0.0
v12.1.0
v12.10.0
v12.11.0
v12.11.1
v12.12.0
v12.13.0
v12.13.1
v12.14.0
v12.14.1
v12.15.0
v12.16.0
v12.16.1
v12.16.2
v12.16.3
v12.17.0
v12.18.0
v12.18.1
v12.18.2
v12.18.3
v12.18.4
v12.19.0
v12.19.1
v12.2.0
v12.20.0
v12.20.1
v12.20.2
v12.21.0
v12.22.0
v12.22.1
v12.22.2
v12.22.3
v12.3.0
v12.3.1
v12.4.0
v12.5.0
v12.6.0
v12.7.0
v12.8.0
v12.8.1
v12.9.0
v12.9.1
v14.*
v14.0.0
v14.1.0
v14.10.0
v14.10.1
v14.11.0
v14.12.0
v14.13.0
v14.13.1
v14.14.0
v14.15.0
v14.15.1
v14.15.2
v14.15.3
v14.15.4
v14.15.5
v14.16.0
v14.16.1
v14.17.0
v14.17.1
v14.17.2
v14.17.3
v14.2.0
v14.3.0
v14.4.0
v14.5.0
v14.6.0
v14.7.0
v14.8.0
v14.9.0
v16.*
v16.0.0
v16.1.0
v16.2.0
v16.3.0
v16.4.0
v16.4.1
v16.4.2
v16.5.0

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-22930.json"