Every CVE Search/ Get API key

CVE-2024-22017

setuid() does not affect libuv's internal io_uring operations if initialized before the call to...

7.3 HighPublic exploitFix available

CVE-2024-22017 is a high vulnerability (CVSS 7.3) in Node.js, published February 16, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in nodejs 1:20.11.1-1.module_el8.9.0+3775+d8460d35.

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
Low

Exploit likelihood

0.89%Up 0.9 points since Mar 19, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.3

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Record
CVE-2024-22017
CVSS 3.0
7.3 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
Weakness
CWE-250
Updated
2026-11-02
EUVDEUVD-2024-19623 7.3

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Record
EUVD-2024-19623
CVSS 3.0
7.3 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-vr4q-vx84-9g5x 7.3

setuid() does not affect libuv's internal io_uring operations if initialized before the call to...

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Record
GHSA-vr4q-vx84-9g5x
CVSS 3.0
7.3 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
Weakness
CWE-250
Updated
2026-11-02
NVD 7.3

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Record
CVE-2024-22017
CVSS 3.0
7.3 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
Weakness
CWE-250
Updated
2026-11-02
OSVBELL-CVE-2024-22017 7.3
Record
BELL-CVE-2024-22017
CVSS 3.0
7.3 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
Updated
2026-11-02
OSVRHSA-2024:1687 8.1

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2024:1687
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 14 moreShow less
OSVRHSA-2024:1688 8.1

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2024:1688
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2024:1688 8.1

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809)

  • nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019)

  • nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)

  • nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)

  • nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891)

  • nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)

  • nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)

Record
RLSA-2024:1688
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2024-22017 7.3

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Record
UBUNTU-CVE-2024-22017
CVSS 3.0
7.3 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
Updated
2026-11-02
OSVALSA-2024:1687 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809)
  • nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019)
  • nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)
  • nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)
  • nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891)
  • nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)
  • nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)
Record
ALSA-2024:1687
Updated
2026-11-02
OSVALSA-2024:1688 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809)
  • nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019)
  • nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)
  • nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)
  • nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891)
  • nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)
  • nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)
Record
ALSA-2024:1688
Updated
2026-11-02
OSVAZL-35886 No score

CVE-2024-22017 affecting package libuv for versions less than 1.48.0-1

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Record
AZL-35886
Updated
2026-11-02
OSVAZL-35899 No score

CVE-2024-22017 affecting package nodejs for versions less than 20.14.0-1

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Record
AZL-35899
Updated
2026-11-02
OSVBIT-node-2024-22017 No score

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Record
BIT-node-2024-22017
Updated
2026-11-02
OSVBIT-node-min-2024-22017 No score

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Record
BIT-node-min-2024-22017
Updated
2026-11-02
OSVopenSUSE-SU-2024:13697-1 No score

corepack20-20.11.1-1.1 on GA media

These are all security issues fixed in the corepack20-20.11.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13697-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13698-1 No score

corepack21-21.6.2-1.1 on GA media

These are all security issues fixed in the corepack21-21.6.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13698-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13972-1 No score

nodejs-electron-29.4.0-1.1 on GA media

These are all security issues fixed in the nodejs-electron-29.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13972-1
Updated
2026-11-02
OSVRLSA-2024:1687 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809)

  • nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019)

  • nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)

  • nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)

  • nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891)

  • nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)

  • nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)

Record
RLSA-2024:1687
Updated
2026-11-02
OSVSUSE-SU-2024:0643-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

Update to 20.11.1: (security updates)

  • CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).
  • CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).
  • CVE-2024-21896: Path traversal by monkey-patching Buffer internals (bsc#1219994).j
  • CVE-2024-22017: setuid() does not drop all privileges due to io_uring (bsc#1219995).
  • CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).
  • CVE-2024-21891: Multiple permission model bypasses due to improper path traversal sequence sanitization (bsc#1219998).
  • CVE-2024-21890: Improper handling of wildcards in --allow-fs-read and --allow-fs-write (bsc#1219999).
  • CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).
  • CVE-2024-24758: undici version 5.28.3 (bsc#1220017).
  • CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).

Update to 20.11.0:

  • esm: add import.meta.dirname and import.meta.filename
  • fs: add c++ fast path for writeFileSync utf8
  • module: remove useCustomLoadersIfPresent flag
  • module: bootstrap module loaders in shadow realm
  • src: add --disable-warning option
  • src: create per isolate proxy env template
  • src: make process binding data weak
  • stream: use Array for Readable buffer
  • stream: optimize creation
  • test_runner: adds built in lcov reporter
  • test_runner: add Date to the supported mock APIs
  • test_runner, cli: add --test-timeout flag

Update to 20.10.0:

  • --experimental-default-type flag to flip module defaults
  • The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected.
  • Added flush option in file system functions for fs.writeFile functions
  • Added experimental WebSocket client
  • vm: fix V8 compilation cache support for vm.Script. This fixes performance regression since v16.x when support for importModuleDynamically was added to vm.Script
Record
SUSE-SU-2024:0643-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
AlmaLinux:8
 before 1:20.11.1-1.module_el8.9.0+3775+d8460d35
1:20.11.1-1.module_el8.9.0+3775+d8460d35
nodejs-devel
AlmaLinux:8
 before 1:20.11.1-1.module_el8.9.0+3775+d8460d35
1:20.11.1-1.module_el8.9.0+3775+d8460d35
nodejs-docs
AlmaLinux:8
 before 1:20.11.1-1.module_el8.9.0+3775+d8460d35
1:20.11.1-1.module_el8.9.0+3775+d8460d35
nodejs-full-i18n
AlmaLinux:8
 before 1:20.11.1-1.module_el8.9.0+3775+d8460d35
1:20.11.1-1.module_el8.9.0+3775+d8460d35
nodejs-nodemon
AlmaLinux:8
 before 3.0.1-1.module_el8.9.0+3731+490e3ce5
3.0.1-1.module_el8.9.0+3731+490e3ce5
nodejs-packaging
AlmaLinux:8
 before 2021.06-4.module_el8.9.0+3684+11b9e959
2021.06-4.module_el8.9.0+3684+11b9e959
nodejs-packaging-bundler
AlmaLinux:8
 before 2021.06-4.module_el8.9.0+3684+11b9e959
2021.06-4.module_el8.9.0+3684+11b9e959
npm
AlmaLinux:8
 before 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35
1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35
nodejs
AlmaLinux:9
 before 1:20.11.1-1.module_el9.3.0+88+29afeaa2
1:20.11.1-1.module_el9.3.0+88+29afeaa2
nodejs-devel
AlmaLinux:9
 before 1:20.11.1-1.module_el9.3.0+88+29afeaa2
1:20.11.1-1.module_el9.3.0+88+29afeaa2
Show 53 moreShow less
Affected packages
PackageAffectedFixed
nodejs-docs
AlmaLinux:9
 before 1:20.11.1-1.module_el9.3.0+88+29afeaa2
1:20.11.1-1.module_el9.3.0+88+29afeaa2
nodejs-full-i18n
AlmaLinux:9
 before 1:20.11.1-1.module_el9.3.0+88+29afeaa2
1:20.11.1-1.module_el9.3.0+88+29afeaa2
nodejs-nodemon
AlmaLinux:9
 before 3.0.1-1.module_el9.3.0+47+c33bc288
3.0.1-1.module_el9.3.0+47+c33bc288
nodejs-packaging
AlmaLinux:9
 before 2021.06-4.module_el9.3.0+48+1cf146a1
2021.06-4.module_el9.3.0+48+1cf146a1
nodejs-packaging-bundler
AlmaLinux:9
 before 2021.06-4.module_el9.3.0+48+1cf146a1
2021.06-4.module_el9.3.0+48+1cf146a1
npm
AlmaLinux:9
 before 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2
1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2
libuv
Azure Linux:3
 before 1.48.0-1
1.48.0-1
nodejs
Azure Linux:3
 before 20.14.0-1
20.14.0-1
nodejs
Alpaquita:stream
 18.16.1-r0 up to 20.11.1-r0
20.11.1-r0
nodejs
BellSoft Hardened Containers:stream
 18.16.1-r0 up to 20.11.1-r0
20.11.1-r0
node
Bitnami
 20.0.0 up to 20.11.1, 21.0.0 up to 21.6.2
20.11.121.6.2
node-min
Bitnami
 20.0.0 up to 20.11.1, 21.0.0 up to 21.6.2
20.11.121.6.2
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:20.11.1-1.module+el8.9.0+21380+12032667
1:20.11.1-1.module+el8.9.0+21380+12032667
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:20.11.1-1.module+el8.9.0+21380+12032667
1:20.11.1-1.module+el8.9.0+21380+12032667
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:20.11.1-1.module+el8.9.0+21380+12032667
1:20.11.1-1.module+el8.9.0+21380+12032667
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:20.11.1-1.module+el8.9.0+21380+12032667
1:20.11.1-1.module+el8.9.0+21380+12032667
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:20.11.1-1.module+el8.9.0+21380+12032667
1:20.11.1-1.module+el8.9.0+21380+12032667
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:20.11.1-1.module+el8.9.0+21380+12032667
1:20.11.1-1.module+el8.9.0+21380+12032667
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.1-1.module+el8.9.0+20473+c4e3d824
0:3.0.1-1.module+el8.9.0+20473+c4e3d824
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.9.0+19519+e25b965a
0:2021.06-4.module+el8.9.0+19519+e25b965a
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.9.0+19519+e25b965a
0:2021.06-4.module+el8.9.0+19519+e25b965a
npm
Red Hat:enterprise_linux:8::appstream
 before 1:10.2.4-1.20.11.1.1.module+el8.9.0+21380+12032667
1:10.2.4-1.20.11.1.1.module+el8.9.0+21380+12032667
nodejs
Red Hat:enterprise_linux:9::appstream
 before 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
1:20.11.1-1.module+el9.3.0+21385+bac43d5a
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
1:20.11.1-1.module+el9.3.0+21385+bac43d5a
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
1:20.11.1-1.module+el9.3.0+21385+bac43d5a
nodejs-devel
Red Hat:enterprise_linux:9::appstream
 before 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
1:20.11.1-1.module+el9.3.0+21385+bac43d5a
nodejs-docs
Red Hat:enterprise_linux:9::appstream
 before 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
1:20.11.1-1.module+el9.3.0+21385+bac43d5a
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
 before 1:20.11.1-1.module+el9.3.0+21385+bac43d5a
1:20.11.1-1.module+el9.3.0+21385+bac43d5a
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.1-1.module+el9.3.0.z+20478+84a9f781
0:3.0.1-1.module+el9.3.0.z+20478+84a9f781
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-4.module+el9.3.0+19518+63aad52d
0:2021.06-4.module+el9.3.0+19518+63aad52d
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-4.module+el9.3.0+19518+63aad52d
0:2021.06-4.module+el9.3.0+19518+63aad52d
npm
Red Hat:enterprise_linux:9::appstream
 before 1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a
1:10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a
nodejs
Rocky Linux:8
 before 1:20.11.1-1.module+el8.9.0+1776+addd4aec
1:20.11.1-1.module+el8.9.0+1776+addd4aec
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.8.0+1459+02651ab6
0:3.0.1-1.module+el8.8.0+1459+02651ab6
nodejs-packaging
Rocky Linux:8
 before 0:2021.06-4.module+el8.7.0+1072+5b168780
0:2021.06-4.module+el8.7.0+1072+5b168780
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01
0:3.0.1-1.module+el9.6.0+32322+a8b1fd01
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.5.0+31770+0da7192d
0:3.0.1-1.module+el9.5.0+31770+0da7192d
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.6.0+32045+2e5d342d
0:3.0.1-1.module+el9.6.0+32045+2e5d342d
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.6.0+32143+ae966e5b
0:3.0.1-1.module+el9.6.0+32143+ae966e5b
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.6.0+32144+1d29a396
0:3.0.1-1.module+el9.6.0+32144+1d29a396
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.6.0+32185+bd121a25
0:3.0.1-1.module+el9.6.0+32185+bd121a25
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.5.0+31770+0da7192d
0:2021.06-4.module+el9.5.0+31770+0da7192d
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.6.0+32045+2e5d342d
0:2021.06-4.module+el9.6.0+32045+2e5d342d
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.6.0+32048+5323bb50
0:2021.06-4.module+el9.6.0+32048+5323bb50
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.6.0+32143+ae966e5b
0:2021.06-4.module+el9.6.0+32143+ae966e5b
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.6.0+32144+1d29a396
0:2021.06-4.module+el9.6.0+32144+1d29a396
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.6.0+32185+bd121a25
0:2021.06-4.module+el9.6.0+32185+bd121a25
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.6.0+32322+a8b1fd01
0:2021.06-4.module+el9.6.0+32322+a8b1fd01
nodejs20
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5
 before 20.11.1-150500.11.6.1
20.11.1-150500.11.6.1
nodejs20
openSUSE:Leap 15.5
 before 20.11.1-150500.11.6.1
20.11.1-150500.11.6.1
nodejs20
openSUSE:Tumbleweed
 before 20.11.1-1.1
20.11.1-1.1
nodejs21
openSUSE:Tumbleweed
 before 21.6.2-1.1
21.6.2-1.1
nodejs-electron
openSUSE:Tumbleweed
 before 29.4.0-1.1
29.4.0-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubSpiralBL0CK/cve-2024-22017_to_test2025-01-12

History

History
WhenChangedSources
2026-11-03affected
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 72 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open