Read the docs
TI-2021-05779 Aliases CVE-2021-22918GHSA-x3cj-3539-rcpx

Out-of-bounds read in NodeJS Node

Priority MEDIUM 44CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 7 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Why it matters now

EPSS 0.23132 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Node (NodeJS): 12.22.2, 14.17.2, 16.4.1Red Hat: 7 advisoriesRed Hat: 7 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeJSNode4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 to before 12.22.2; 13.0 and later; 14.0 to before 14.17.2; 15.0 and later; 16.0 to before 16.4.112.22.2, 14.17.2, 16.4.1Patch availableCNA
  • Node VendorNodeJS Affected 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 to before 12.22.2; 13.0 and later; 14.0 to before 14.17.2; 15.0 and later; 16.0 to before 16.4.1 Fixed in 12.22.2, 14.17.2, 16.4.1 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*12.0.0 to before 12.22.2; 14.0.0 to before 14.17.2; 16.0.0 to before 16.4.1VulnerableNodeJS
cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*before 1.0.1.1VulnerableSiemens
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 12.0.0 to before 12.22.2; 14.0.0 to before 14.17.2; 16.0.0 to before 16.4.1 Vulnerable ·NodeJS
  • cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* Versions before 1.0.1.1 Vulnerable ·Siemens

Remediation

  • Fix · CNA Node (NodeJS) Fixed in 12.22.2, 14.17.2, 16.4.1

Red Hat 7 advisories

  • RHSA-2021:3638 Released 2021-09-22 · Red Hat rating Important
    nodejs:12 security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.2) nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.aarch64::nodejs:12, nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.ppc64le::nodejs:12, nodejs-1:12.22.5-1.module+el8.2.0+12241+a3db445b.s390x::nodejs:12 +19
  • RHSA-2021:3639 Released 2021-09-22 · Red Hat rating Important
    nodejs:12 security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.aarch64::nodejs:12, nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.ppc64le::nodejs:12, nodejs-1:12.22.5-1.module+el8.1.0+12238+63fe3aec.s390x::nodejs:12 +19
  • RHSA-2021:3074 Released 2021-08-10 · Red Hat rating Moderate
    nodejs:14 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:14.17.3-2.module+el8.4.0+11738+3bd42762.aarch64::nodejs:14, nodejs-1:14.17.3-2.module+el8.4.0+11738+3bd42762.ppc64le::nodejs:14, nodejs-1:14.17.3-2.module+el8.4.0+11738+3bd42762.s390x::nodejs:14 +19
Show 4 more Red Hat advisories
  • RHSA-2021:3073 Released 2021-08-10 · Red Hat rating Moderate
    nodejs:12 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.22.3-2.module+el8.4.0+11732+c668cc9f.aarch64::nodejs:12, nodejs-1:12.22.3-2.module+el8.4.0+11732+c668cc9f.ppc64le::nodejs:12, nodejs-1:12.22.3-2.module+el8.4.0+11732+c668cc9f.s390x::nodejs:12 +19
  • RHSA-2021:3075 Released 2021-08-10 · Red Hat rating Low
    libuv security update
    • Red Hat CodeReady Linux Builder (v. 8) libuv-devel-1:1.41.1-1.el8_4
    • Red Hat Enterprise Linux AppStream (v. 8) libuv-1:1.41.1-1.el8_4
  • RHSA-2021:2932 Released 2021-07-28 · Red Hat rating Moderate
    rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs-14.17.2-1.el7, rh-nodejs14-nodejs-devel-14.17.2-1.el7, rh-nodejs14-nodejs-docs-14.17.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs-14.17.2-1.el7, rh-nodejs14-nodejs-devel-14.17.2-1.el7, rh-nodejs14-nodejs-docs-14.17.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs-14.17.2-1.el7, rh-nodejs14-nodejs-devel-14.17.2-1.el7, rh-nodejs14-nodejs-docs-14.17.2-1.el7 +2
  • RHSA-2021:2931 Released 2021-07-28 · Red Hat rating Moderate
    rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.22.2-1.el7, rh-nodejs12-nodejs-devel-12.22.2-1.el7, rh-nodejs12-nodejs-docs-12.22.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.22.2-1.el7, rh-nodejs12-nodejs-devel-12.22.2-1.el7, rh-nodejs12-nodejs-docs-12.22.2-1.el7 +2
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.22.2-1.el7, rh-nodejs12-nodejs-devel-12.22.2-1.el7, rh-nodejs12-nodejs-docs-12.22.2-1.el7 +2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    NodeJS Node 10.*, 11.* and 11 more versions

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2021-05782 Incorrect permission assignment in NodeJS NodePriority MEDIUM 44
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix yet: Fix deferred
A-MQ Interconnect 1AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 13 (Queens) Operational ToolsAffectedNo fix planned: Out of support scope
Red Hat Quay 3AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2021:3075
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:3073, RHSA-2021:3074, RHSA-2021:3075
Red Hat Enterprise Linux AppStream EUS (v. 8.1)Fixed RHSA-2021:3639
Red Hat Enterprise Linux AppStream EUS (v. 8.2)Fixed RHSA-2021:3638
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:2931, RHSA-2021:2932
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:2931, RHSA-2021:2932
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:2931, RHSA-2021:2932
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22918
  2. 2026-10-03 Alias added: GHSA-x3cj-3539-rcpx

References

Exploit 1

Patch 2

Advisory 2

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
  • TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
  • TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
  • TI-2022-03315 X.509 Email Address 4-byte Buffer Overflow CVSS 3.1HIGH 7.5
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences