CVE-2021-22930
published 2021-10-07CVE-2021-22930: Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
37.29%
98.4th percentile
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | nodejs | < nodejs 12.22.4~dfsg-1 (bookworm) | nodejs 12.22.4~dfsg-1 (bookworm) |
| msrc | cbl2_nodejs_16.14.0-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.22.4 | 12.22.4 |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.17.4 | 14.17.4 |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.6.0 | 16.6.0 |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | node.js | >= 12.0.0 < 12.22.4 | 12.22.4 |
| nodejs | node.js | >= 14.0.0 < 14.17.4 | 14.17.4 |
| nodejs | node.js | >= 16.0.0 < 16.6.0 | 16.6.0 |
| nodejs | nodejs | >= 0 < 12.22.5~dfsg-2~11u1 | 12.22.5~dfsg-2~11u1 |
| nodejs | nodejs | >= 0 < 12.22.4~dfsg-1 | 12.22.4~dfsg-1 |
| nodejs | nodejs | >= 0 < 12.22.4~dfsg-1 | 12.22.4~dfsg-1 |
| nodejs | nodejs | >= 0 < 12.22.4~dfsg-1 | 12.22.4~dfsg-1 |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2021-22930 is a use-after-free vulnerability triggered via HTTP/2 stream cancellation in Node.js; monitor for unexpected process crashes or behavior changes in Node.js HTTP/2 servers as a potential exploitation indicator ↗
- →The vulnerability is specifically in the HTTP/2 close-on-stream-canceling code path; detection should focus on anomalous HTTP/2 stream cancellation patterns sent to Node.js servers running versions before 16.6.0, 14.17.4, or 12.22.4 ↗
- →The Red Hat advisory titles this as 'Use-after-free on close http2 on stream canceling', confirming the attack vector is HTTP/2 stream cancellation; alert on Node.js process crashes (SIGSEGV/memory corruption) originating from HTTP/2 handler code ↗
- ·The fix for CVE-2021-22930 was incomplete; CVE-2021-22940 is a follow-up addressing the same use-after-free in HTTP/2 stream cancellation. Patching to 16.6.0/14.17.4/12.22.4 alone may not be sufficient — patch to 16.6.1/14.17.5/12.22.5 or later to fully remediate. ↗
- ·Red Hat Enterprise Linux 8 Node.js streams and Red Hat Software Collections are not affected by the incomplete fix (CVE-2021-22930 patch was never released to those channels), but the original underlying vulnerability does affect those components. ↗
- ·The highest threat from this vulnerability is to confidentiality and integrity, meaning successful exploitation could allow an attacker to change process behavior beyond a simple crash. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC INS
cisa_ics·2022-03-10·CVSS 5.9
[MEDIUM] Siemens SINEC INS
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINEC INS
Last RevisedMarch 10, 2022
Alert CodeICSA-22-069-09
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerability: Using Components with Known Vulnerabilities
## 2. RISK EVALUATION
Successful exploitation of this vulnerability in third-party components could allow an attacker to interfere with the affected product in various ways.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Siemens reports this vulnerability affects the following SINEC INS (Infrastructure Netw
Microsoft
Node.js before 16.6.0 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption to change process behavior.
vendor_msrc·2021-10-12·CVSS 9.8
CVE-2021-22930 [CRITICAL] CWE-416 Node.js before 16.6.0 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption to change process behavior.
Node.js before 16.6.0 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption to change process behavior.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Ma
Red Hat
nodejs: Use-after-free on close http2 on stream canceling
vendor_redhat·2021-08-11·CVSS 9.8
CVE-2021-22940 [CRITICAL] CWE-416 nodejs: Use-after-free on close http2 on stream canceling
nodejs: Use-after-free on close http2 on stream canceling
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
A flaw was found in Node.js, where it is vulnerable to a use-after-free attack. This flaw allows an attacker to exploit memory corruption to change process behavior. The highest threat from this vulnerability is to confidentiality and integrity.
Statement: This issue is a follow-up to CVE-2021-22930, as the issue was not completely resolved in the fix for CVE-2021-22930. Node.js as shipped in Red Hat Enterprise Linux 8 streams and Red Hat Software Collections is not explicitly affected by the incomplete fix because the incomplete fix was not released, bu
Red Hat
nodejs: Use-after-free on close http2 on stream canceling
vendor_redhat·2021-07-29·CVSS 9.8
CVE-2021-22930 [CRITICAL] CWE-416 nodejs: Use-after-free on close http2 on stream canceling
nodejs: Use-after-free on close http2 on stream canceling
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
A flaw was found in Node.js, where it is vulnerable to a use-after-free attack. This flaw allows an attacker to exploit the memory corruption, which causes a change in the process behavior. The highest threat from this vulnerability is to confidentiality and integrity.
Statement: Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.3 and 3.2 because nodejs is only used at build time and is no longer ship
Debian
CVE-2021-22930: nodejs - Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free at...
vendor_debian·2021·CVSS 9.8
CVE-2021-22930 [CRITICAL] CVE-2021-22930: nodejs - Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free at...
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
Scope: local
bookworm: resolved (fixed in 12.22.4~dfsg-1)
bullseye: resolved (fixed in 12.22.5~dfsg-2~11u1)
forky: resolved (fixed in 12.22.4~dfsg-1)
sid: resolved (fixed in 12.22.4~dfsg-1)
trixie: resolved (fixed in 12.22.4~dfsg-1)
GHSA
Use After Free in node.js
ghsa_unreviewed·2021-10-08
CVE-2021-22930 [CRITICAL] CWE-416 Use After Free in node.js
Use After Free in node.js
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
OSV
CVE-2021-22930: Node
osv·2021-10-07·CVSS 9.8
CVE-2021-22930 [CRITICAL] CVE-2021-22930: Node
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
No detection rules found.
No public exploits indexed.
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://hackerone.com/reports/1238162https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlhttps://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/https://security.gentoo.org/glsa/202401-02https://security.netapp.com/advisory/ntap-20211112-0002/https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://hackerone.com/reports/1238162https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlhttps://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/https://security.gentoo.org/glsa/202401-02https://security.netapp.com/advisory/ntap-20211112-0002/
2021-10-07
Published