CVE-2021-22883: High severity ibm cloud pak for security vulnerability
A flaw was found in nodejs. When too many connection attempts with an 'unknownProtocol' are established a leak of file descriptors can occur leading to a potential denial of service. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening. If no file descriptor limit is configured, then this can lead to an excessive memory usage and cause the system to run out of memory. The highest threat from this vulnerability is to system availability.
Other sources
Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
Reference: https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/#update-23-feb-2021-security-releases-available
— Red Hat
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
Node.js is vulnerable to a denial of service, caused by a file descriptor leak. By making multiple attempts to connect with an 'unknownProtocol', an attacker could exploit this vulnerability to lead to an excessive memory usage and cause the system to run out of memory.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-22883?
CVE-2021-22883 is a vulnerability in Node.js that can lead to a denial of service due to a file descriptor leak.
How does CVE-2021-22883 affect Node.js?
CVE-2021-22883 affects Node.js by causing a potential denial of service when too many connection attempts with an 'unknownProtocol' are established and a file descriptor leak occurs.
What is the severity of CVE-2021-22883?
CVE-2021-22883 has a severity rating of high.
Which versions of Node.js are affected by CVE-2021-22883?
CVE-2021-22883 affects Node.js versions 15.10.0, 14.16.0, 12.21.0, and 10.24.0.
How can I fix CVE-2021-22883 in Node.js?
To fix CVE-2021-22883, update Node.js to version 15.10.0, 14.16.0, 12.21.0, or 10.24.0, depending on the version you are currently using.