CVE-2021-22930: Use After Free
A flaw was found in Node.js, where it is vulnerable to a use-after-free attack. This flaw allows an attacker to exploit the memory corruption, which causes a change in the process behavior. The highest threat from this vulnerability is to confidentiality and integrity.
Other sources
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
Node.js could allow a remote attacker to bypass security restrictions, caused by a use-after-free on close http2 on stream canceling. An attacker could exploit this vulnerability to corrupt memory to change process behavior.
— IBM
Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
Reference: https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-22930?
CVE-2021-22930 is a vulnerability in Node.js that allows for a use-after-free attack, leading to memory corruption and a change in process behavior.
What is the severity of CVE-2021-22930?
CVE-2021-22930 has a severity rating of critical, with a severity value of 9.
What software versions are affected by CVE-2021-22930?
Versions before Node.js 16.6.0, 14.17.4, and 12.22.4 are affected by CVE-2021-22930.
How can I fix CVE-2021-22930?
To fix CVE-2021-22930, update to Node.js versions 16.6.0, 14.17.4, or 12.22.4.
What is a use-after-free attack?
A use-after-free attack is a type of memory corruption attack where an attacker manipulates object references after they have been freed, leading to unintended behavior and potential exploitation.