Lucene search

K

HackeroneCVELIST:CVE-2021-22940

HistoryAug 16, 2021 - 12:00 a.m.

CVE-2021-22940

2021-08-1600:00:00

CWE-416

hackerone

www.cve.org

8

node.js

vulnerability

use after free

memory corruption

process behavior

AI Score

8.8

Confidence

High

EPSS

0.009

Percentile

82.8%

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/nodejs/node",
    "versions": [
      {
        "version": "Fixed versions 16.6.2, 14.17.5, and 12.22.5",
        "status": "affected"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

hackerone.com/reports/1238162

lists.debian.org/debian-lts-announce/2022/10/msg00006.html

nodejs.org/en/blog/vulnerability/aug-2021-security-releases/

security.gentoo.org/glsa/202401-02

security.netapp.com/advisory/ntap-20210923-0001/

www.oracle.com/security-alerts/cpujan2022.html

www.oracle.com/security-alerts/cpujul2022.html

www.oracle.com/security-alerts/cpuoct2021.html

AI Score

8.8

Confidence

High

EPSS

0.009

Percentile

82.8%

Related for CVELIST:CVE-2021-22940

ubuntucve1 prion1 cbl_mariner2 osv9 nvd1 debiancve1 veracode1 cve1 redhatcve1 ibm18 nessus28 openvas15 nodejsblog1 freebsd1 photon2 suse5 archlinux2 debian1 gentoo2 rocky2 redhat6 oraclelinux2 almalinux2 mageia1 ics1 oracle3