CVE-2021-22940

🗓️ 16 Aug 2021 00:00:00Reported by hackeroneType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 335 Views

Node.js use after free attack vulnerabilit

Reporter	Title	Published	Views	Family All 191
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Services	9 Nov 202118:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, IBM WebSphere Application Server Liberty, and OpenSSL affect IBM Spectrum Control	9 Dec 202107:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in Node.js affect IBM Voice Gateway	21 Oct 202117:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js	29 Oct 202121:37	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilitiy affects IBM Observability with Instana	11 Jan 202220:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities	20 Apr 202214:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities fixed in Cloud Pak for Automation components	19 Jan 202216:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	31 May 202214:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js	22 Aug 202215:20	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, Color-String, and PostgreSQL affect IBM Spectrum Protect Plus	10 Dec 202120:01	–	ibm

NVD

Vulners

Node

nodejs node.jsRange12.0.0–12.22.5lts

nodejs node.jsRange14.0.0–14.17.5lts

nodejs node.jsRange16.0.0–16.6.2-

Node

oracle graalvmMatch20.3.3enterprise

oracle graalvmMatch21.2.0enterprise

oracle jd_edwards_enterpriseone_toolsRange≤9.2.6.1

oracle peoplesoft_enterprise_peopletoolsMatch8.57

oracle peoplesoft_enterprise_peopletoolsMatch8.58

oracle peoplesoft_enterprise_peopletoolsMatch8.59

Node

netapp nextgen_apiMatch-

Node

siemens sinec_infrastructure_network_servicesRange<1.0.1.1

Node

debian debian_linuxMatch10.0

[
  {
    "product": "Node",
    "vendor": "NodeJS",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "4.0",
        "status": "affected",
        "lessThan": "4.*"
      },
      {
        "versionType": "semver",
        "version": "5.0",
        "status": "affected",
        "lessThan": "5.*"
      },
      {
        "versionType": "semver",
        "version": "6.0",
        "status": "affected",
        "lessThan": "6.*"
      },
      {
        "versionType": "semver",
        "version": "7.0",
        "status": "affected",
        "lessThan": "7.*"
      },
      {
        "versionType": "semver",
        "version": "8.0",
        "status": "affected",
        "lessThan": "8.*"
      },
      {
        "versionType": "semver",
        "version": "9.0",
        "status": "affected",
        "lessThan": "9.*"
      },
      {
        "versionType": "semver",
        "version": "10.0",
        "status": "affected",
        "lessThan": "10.*"
      },
      {
        "versionType": "semver",
        "version": "11.0",
        "status": "affected",
        "lessThan": "11.*"
      },
      {
        "versionType": "semver",
        "version": "12.0",
        "status": "affected",
        "lessThan": "12.22.5"
      },
      {
        "versionType": "semver",
        "version": "13.0",
        "status": "affected",
        "lessThan": "13.*"
      },
      {
        "versionType": "semver",
        "version": "14.0",
        "status": "affected",
        "lessThan": "14.17.5"
      },
      {
        "versionType": "semver",
        "version": "15.0",
        "status": "affected",
        "lessThan": "15.*"
      },
      {
        "versionType": "semver",
        "version": "16.0",
        "status": "affected",
        "lessThan": "16.6.2"
      }
    ]
  }
]

Source	Link
hackerone	www.hackerone.com/reports/1238162
lists	www.lists.debian.org/debian-lts-announce/2022/10/msg00006.html
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
nodejs	www.nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
security	www.security.netapp.com/advisory/ntap-20210923-0001/
security	www.security.gentoo.org/glsa/202401-02
oracle	www.oracle.com/security-alerts/cpujul2022.html
oracle	www.oracle.com/security-alerts/cpujan2022.html
oracle	www.oracle.com/security-alerts/cpuoct2021.html

17 Jun 2026 03:38Current

8.4High risk

Vulners AI Score8.4

CVSS 25

CVSS 3.17.5

EPSS0.13861

CWE-416