PT-2021-5821 · Node.Js+7 · Node.Js+7
Eran Levin
+1
·
Published
2021-07-30
·
Updated
2026-05-18
·
CVE-2021-22930
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Node.js versions prior to 12.22.4
Node.js versions prior to 14.17.4
Node.js versions prior to 16.6.0
Description
The issue is related to a use after free attack in Node.js, where an attacker might exploit memory corruption to change process behavior, potentially leading to access to confidential data, disruption of data integrity, and denial of service. The vulnerability is associated with the http2 module, which could allow an attacker to crash the process or potentially execute code in the system when accessing a host controlled by the attacker.
Recommendations
For versions prior to 12.22.4, update to version 12.22.4 or later.
For versions prior to 14.17.4, update to version 14.17.4 or later.
For versions prior to 16.6.0, update to version 16.6.0 or later.
As a temporary workaround, consider disabling the http2 module until a patch is available.
Restrict access to the http2 module to minimize the risk of exploitation.
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Node.Js
Red Hat
Rocky Linux
Suse