CVE-2021-22940

CVSS v3.1 7.5 (High)

CVSS v2.0 5 (Medium)

EPSS 0.89 % (83^th)

Affected Products 7

Advisories 20

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Weaknesses

CWE-416: Use After Free

CVE Status: PUBLISHED
CNA: HackerOne
Published Date: 2021-08-16 19:15:13
(3 years ago)
Updated Date: 2024-01-05 10:15:10
(8 months ago)

Affected Products

Oracle

Siemens

Sinec Infrastructure Network Services

Configuration #1

	CPE23	From	Up To
Nodejs Node.js from 12.0.0 version and prior 12.22.5 version	cpe:2.3:a:nodejs:node.js::::*:lts	>= 12.0.0	< 12.22.5
Nodejs Node.js from 14.0.0 version and prior 14.17.5 version	cpe:2.3:a:nodejs:node.js::::*:lts	>= 14.0.0	< 14.17.5
Nodejs Node.js from 16.0.0 version and prior 16.6.2 version	cpe:2.3:a:nodejs:node.js::::*:-	>= 16.0.0	< 16.6.2

Configuration #2

	CPE23	Up To
Oracle Graalvm 20.3.3	cpe:2.3:a:oracle:graalvm:20.3.3:::*:enterprise
Oracle Graalvm 21.2.0	cpe:2.3:a:oracle:graalvm:21.2.0:::*:enterprise
Oracle Jd Edwards Enterpriseone Tools 9.2.6.1 and prior versions	cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools	<= 9.2.6.1
Oracle Peoplesoft Enterprise Peopletools 8.57	cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57
Oracle Peoplesoft Enterprise Peopletools 8.58	cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58
Oracle Peoplesoft Enterprise Peopletools 8.59	cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59

Configuration #3

		CPE23	From	Up To
	Netapp Nextgen Api	cpe:2.3:a:netapp:nextgen_api:-

Configuration #4

		CPE23	From	Up To
	Siemens Sinec Infrastructure Network Services prior 1.0.1.1 version	cpe:2.3:a:siemens:sinec_infrastructure_network_services		< 1.0.1.1

Configuration #5

		CPE23	From	Up To
	Debian Linux 10.0	cpe:2.3:o:debian:debian_linux:10.0

Weaknesses

Affected Products

Debian

Netapp

Nodejs