CVE-2021-22918: Medium severity IBM Cognos Controller vulnerability

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uvidnatoascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uvgetaddrinfo().

Node.js is vulnerable to a denial of service, caused by an out-of-bounds read in the libuv's uvidnatoascii() function. By invoking the function using dns module's lookup() function, a remote attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service.

— IBM

Node.js is vulnerable to out-of-bounds read in libuv's uvidnatoascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes.

Reference: https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/

— Red Hat