CVE-2021-22930: Use after free on close http2 on stream canceling
A flaw was found in Node.js, where it is vulnerable to a use-after-free attack. This flaw allows an attacker to exploit the memory corruption, which causes a change in the process behavior. The highest threat from this vulnerability is to confidentiality and integrity.
Other sources
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
Node.js before is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930
— Node.Js
Node.js could allow a remote attacker to bypass security restrictions, caused by a use-after-free on close http2 on stream canceling. An attacker could exploit this vulnerability to corrupt memory to change process behavior.
— IBM
Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
Reference: https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/
— Red Hat
Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930
All versions of the 16.x, 14.x, and 12.x releases lines
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-nodejs14-nodejsto a version that resolves this vulnerability.Fixed in 0:14.17.5-1.el7 - Upgrade
Upgrade
redhat/rh-nodejs12-nodejsto a version that resolves this vulnerability.Fixed in 0:12.22.5-1.el7 - Upgrade
Upgrade
redhat/rh-nodejs12-nodejs-nodemonto a version that resolves this vulnerability.Fixed in 0:2.0.3-5.el7 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 12.22.4 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 14.17.4 - Upgrade
Upgrade
redhat/nodejsto a version that resolves this vulnerability.Fixed in 16.6.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.22.4Fixed in 14.17.4Fixed in 16.6.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.22.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.22.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.17.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.17.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.6.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.6.0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 12.22.4-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 14.17.4-r0 - Upgrade
Upgrade
alpine/nodejs-currentto a version that resolves this vulnerability.Fixed in 16.6.0-r0 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 16.6.0 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 14.17.4 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 12.22.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-22930?
CVE-2021-22930 is a vulnerability in Node.js that allows for a use-after-free attack, leading to memory corruption and a change in process behavior.
What is the severity of CVE-2021-22930?
CVE-2021-22930 has a severity rating of critical, with a severity value of 9.
What software versions are affected by CVE-2021-22930?
Versions before Node.js 16.6.0, 14.17.4, and 12.22.4 are affected by CVE-2021-22930.
How can I fix CVE-2021-22930?
To fix CVE-2021-22930, update to Node.js versions 16.6.0, 14.17.4, or 12.22.4.
What is a use-after-free attack?
A use-after-free attack is a type of memory corruption attack where an attacker manipulates object references after they have been freed, leading to unintended behavior and potential exploitation.