CVE-2021-22940

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an...

7.5 HighFix available

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

13.9%Up 13.4 points since Aug 17, 2021

What each source reports

NVD Score used 7.5

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Record: CVE-2021-22940
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Record: CVE-2021-22940
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2021-10069 No score

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Record: EUVD-2021-10069
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6hhj-4h22-mrmm 7.5

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an...

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Record: GHSA-6hhj-4h22-mrmm
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-416
Updated: 2026-11-02

OSVAZL-6745 7.5

CVE-2021-22940 affecting package nodejs for versions less than 16.14.0-1

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Record: AZL-6745
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSV 7.5

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Record: CVE-2021-22940
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

Show 26 moreShow less

OSVDEBIAN-CVE-2021-22940 7.5

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Record: DEBIAN-CVE-2021-22940
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2021:3280 9.8

Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

Record: RHSA-2021:3280
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:3281 9.8

Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update

Record: RHSA-2021:3281
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:3623 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record: RHSA-2021:3623
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:3638 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record: RHSA-2021:3638
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:3639 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record: RHSA-2021:3639
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2021:3666 9.8

Red Hat Security Advisory: nodejs:14 security and bug fix update

Record: RHSA-2021:3666
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2021:3623 9.8

Important: nodejs:12 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)
nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)
c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)
nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)
nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)
nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)
nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)
nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)

Record: RLSA-2021:3623
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2021:3666 9.8

Important: nodejs:14 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)
nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)
c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)
nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)
nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)
nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)
nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)
nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)

Record: RLSA-2021:3666
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-22940 7.5

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Record: UBUNTU-CVE-2021-22940
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVALSA-2021:3623 No score

Important: nodejs:12 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)
nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)
c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)
nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)
nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)
nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)
nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)
nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)

Record: ALSA-2021:3623
Updated: 2026-11-02

OSVALSA-2021:3666 No score

Important: nodejs:14 security and bug fix update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)
nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)
c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)
nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)
nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)
nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)
nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)
nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)

Record: ALSA-2021:3666
Updated: 2026-11-02

OSVBIT-node-2021-22940 No score

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Record: BIT-node-2021-22940
Updated: 2026-11-02

OSVBIT-node-min-2021-22940 No score

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Record: BIT-node-min-2021-22940
Updated: 2026-11-02

OSVMGASA-2021-0463 No score

Updated nodejs packages fix security vulnerability

Multiple security fixes for nodejs. See references for details

Record: MGASA-2021-0463
Updated: 2026-11-02

OSVopenSUSE-SU-2021:1214-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

Update to 12.22.5:

CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)
CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record: openSUSE-SU-2021:1214-1
Updated: 2026-11-02

OSVopenSUSE-SU-2021:1313-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record: openSUSE-SU-2021:1313-1
Updated: 2026-11-02

OSVopenSUSE-SU-2021:2875-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

Update to 12.22.5:

CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)
CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)

Record: openSUSE-SU-2021:2875-1
Updated: 2026-11-02

OSVopenSUSE-SU-2021:3211-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).

Record: openSUSE-SU-2021:3211-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11096-1 No score

nodejs14-14.17.5-1.2 on GA media

These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11096-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11097-1 No score

nodejs16-16.6.2-2.2 on GA media

These are all security issues fixed in the nodejs16-16.6.2-2.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11097-1
Updated: 2026-11-02

OSVSUSE-SU-2021:2824-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

Update to 12.22.5:

CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)
CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)

Record: SUSE-SU-2021:2824-1
Updated: 2026-11-02

OSVSUSE-SU-2021:2875-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

Update to 12.22.5:

CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)
CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)

Record: SUSE-SU-2021:2875-1
Updated: 2026-11-02

OSVSUSE-SU-2021:3184-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).

Record: SUSE-SU-2021:3184-1
Updated: 2026-11-02

OSVSUSE-SU-2021:3211-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).

Record: SUSE-SU-2021:3211-1
Updated: 2026-11-02

OSVSUSE-SU-2022:2855-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

CVE-2021-22930, CVE-2021-22940: Fixed two memory corruption issues during HTTP/2 stream cancellation (bsc#1188917, bsc#1189368).
CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2021-22960, CVE-2021-22959: Fixed multiple HTTP request smuggling issues in the underlying HTTP parser (bsc#1201325, bsc#1201326, bsc#1201327, bsc#1191602, bsc#1191601).
CVE-2022-32212: Fixed a DNS rebinding issue caused by improper IPv4 validation (bsc#1201328).

Record: SUSE-SU-2022:2855-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`nodejs` AlmaLinux:8 From an advisory covering 8 CVEs	before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7	1:12.22.5-1.module_el8.4.0+2529+af52a4c7
`nodejs` AlmaLinux:8 From an advisory covering 8 CVEs	before 1:12.22.5-1.module_el8.5.0+85+79a7b441	1:12.22.5-1.module_el8.5.0+85+79a7b441
`nodejs-devel` AlmaLinux:8 From an advisory covering 8 CVEs	before 1:12.22.5-1.module_el8.5.0+85+79a7b441	1:12.22.5-1.module_el8.5.0+85+79a7b441
`nodejs-devel` AlmaLinux:8 From an advisory covering 8 CVEs	before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7	1:12.22.5-1.module_el8.4.0+2529+af52a4c7
`nodejs-docs` AlmaLinux:8 From an advisory covering 8 CVEs	before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7	1:12.22.5-1.module_el8.4.0+2529+af52a4c7
`nodejs-full-i18n` AlmaLinux:8 From an advisory covering 8 CVEs	before 1:12.22.5-1.module_el8.5.0+85+79a7b441	1:12.22.5-1.module_el8.5.0+85+79a7b441
`nodejs-full-i18n` AlmaLinux:8 From an advisory covering 8 CVEs	before 1:12.22.5-1.module_el8.4.0+2529+af52a4c7	1:12.22.5-1.module_el8.4.0+2529+af52a4c7
`nodejs-nodemon` AlmaLinux:8 From an advisory covering 8 CVEs	before 2.0.3-1.module_el8.4.0+2521+c668cc9f	2.0.3-1.module_el8.4.0+2521+c668cc9f
`nodejs-packaging` AlmaLinux:8 From an advisory covering 8 CVEs	before 17-3.module_el8.4.0+2224+b07ac28e	17-3.module_el8.4.0+2224+b07ac28e
`nodejs-packaging` AlmaLinux:8 From an advisory covering 8 CVEs	before 17-3.module_el8.4.0+2521+c668cc9f	17-3.module_el8.4.0+2521+c668cc9f

Show 103 moreShow less

Affected packages
Package	Affected	Fixed
`nodejs-packaging` AlmaLinux:8 From an advisory covering 8 CVEs	before 17-3.module_el8.3.0+2023+d2377ea3	17-3.module_el8.3.0+2023+d2377ea3
`npm` AlmaLinux:8 From an advisory covering 8 CVEs	before 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7	1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7
`npm` AlmaLinux:8 From an advisory covering 8 CVEs	before 1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441	1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441
`nodejs-packaging` AlmaLinux:8 From an advisory covering 8 CVEs	before 23-3.module_el8.5.0+254+b4526b16	23-3.module_el8.5.0+254+b4526b16
`nodejs-packaging` AlmaLinux:8 From an advisory covering 8 CVEs	before 23-3.module_el8.4.0+2522+3bd42762	23-3.module_el8.4.0+2522+3bd42762
`nodejs` Azure Linux:2	before 16.14.0-1	16.14.0-1
`node` Bitnami	12.0.0 up to 12.22.5, 14.0.0 up to 14.17.5, 16.0.0 up to 16.6.2	12.22.514.17.516.6.2
`node-min` Bitnami	12.0.0 up to 12.22.5, 14.0.0 up to 14.17.5, 16.0.0 up to 16.6.2	12.22.514.17.516.6.2
`nodejs` Debian:12	before 12.22.5~dfsg-1	12.22.5~dfsg-1
`nodejs` Debian:13	before 12.22.5~dfsg-1	12.22.5~dfsg-1
`nodejs` Debian:14	before 12.22.5~dfsg-1	12.22.5~dfsg-1
`nodejs` Debian:10 From an advisory covering 5 CVEs	before 10.24.0~dfsg-1~deb10u2, plus listed versions 10.15.2~dfsg-210.15.3~dfsg-110.16.3~dfsg-110.17.0~dfsg-110.17.0~dfsg-2 Show 10 moreShow less 10.19.0~dfsg-110.19.0~dfsg-210.19.0~dfsg-310.19.0~dfsg1-110.20.0~dfsg-110.20.1~dfsg-110.21.0~dfsg-110.21.0~dfsg-1~deb10u110.23.1~dfsg-1~deb10u110.24.0~dfsg-1~deb10u1	10.24.0~dfsg-1~deb10u2
`nodejs` Mageia:8 From an advisory covering 9 CVEs	before 14.17.6-1.mga8	14.17.6-1.mga8
`rh-nodejs14-nodejs-nodemon` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:2.0.3-5.el7	0:2.0.3-5.el7
`rh-nodejs14-nodejs` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:14.17.5-1.el7	0:14.17.5-1.el7
`rh-nodejs14-nodejs-debuginfo` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:14.17.5-1.el7	0:14.17.5-1.el7
`rh-nodejs14-nodejs-devel` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:14.17.5-1.el7	0:14.17.5-1.el7
`rh-nodejs14-nodejs-docs` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:14.17.5-1.el7	0:14.17.5-1.el7
`rh-nodejs14-npm` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:6.14.14-14.17.5.1.el7	0:6.14.14-14.17.5.1.el7
`rh-nodejs12-nodejs` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:12.22.5-1.el7	0:12.22.5-1.el7
`rh-nodejs12-nodejs-debuginfo` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:12.22.5-1.el7	0:12.22.5-1.el7
`rh-nodejs12-nodejs-devel` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:12.22.5-1.el7	0:12.22.5-1.el7
`rh-nodejs12-nodejs-docs` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:12.22.5-1.el7	0:12.22.5-1.el7
`rh-nodejs12-nodejs-nodemon` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:2.0.3-5.el7	0:2.0.3-5.el7
`rh-nodejs12-npm` Red Hat:rhel_software_collections:3::el7 From an advisory covering 10 CVEs	before 0:6.14.14-12.22.5.1.el7	0:6.14.14-12.22.5.1.el7
`nodejs` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
`nodejs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
`nodejs-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
`nodejs-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
`nodejs-docs` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
`nodejs-full-i18n` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:12.22.5-1.module+el8.4.0+12242+af52a4c7	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
`nodejs-nodemon` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 0:2.0.3-1.module+el8.4.0+11732+c668cc9f	0:2.0.3-1.module+el8.4.0+11732+c668cc9f
`nodejs-packaging` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 0:17-3.module+el8.1.0+3369+37ae6a45	0:17-3.module+el8.1.0+3369+37ae6a45
`npm` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7	1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7
`nodejs` Red Hat:rhel_eus:8.2::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.2.0+12241+a3db445b	1:12.22.5-1.module+el8.2.0+12241+a3db445b
`nodejs-debuginfo` Red Hat:rhel_eus:8.2::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.2.0+12241+a3db445b	1:12.22.5-1.module+el8.2.0+12241+a3db445b
`nodejs-debugsource` Red Hat:rhel_eus:8.2::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.2.0+12241+a3db445b	1:12.22.5-1.module+el8.2.0+12241+a3db445b
`nodejs-devel` Red Hat:rhel_eus:8.2::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.2.0+12241+a3db445b	1:12.22.5-1.module+el8.2.0+12241+a3db445b
`nodejs-docs` Red Hat:rhel_eus:8.2::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.2.0+12241+a3db445b	1:12.22.5-1.module+el8.2.0+12241+a3db445b
`nodejs-full-i18n` Red Hat:rhel_eus:8.2::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.2.0+12241+a3db445b	1:12.22.5-1.module+el8.2.0+12241+a3db445b
`nodejs-nodemon` Red Hat:rhel_eus:8.2::appstream From an advisory covering 11 CVEs	before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45	0:1.18.3-1.module+el8.1.0+3369+37ae6a45
`nodejs-packaging` Red Hat:rhel_eus:8.2::appstream From an advisory covering 11 CVEs	before 0:17-3.module+el8.1.0+3369+37ae6a45	0:17-3.module+el8.1.0+3369+37ae6a45
`npm` Red Hat:rhel_eus:8.2::appstream From an advisory covering 11 CVEs	before 1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b	1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b
`nodejs` Red Hat:rhel_eus:8.1::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
`nodejs-debuginfo` Red Hat:rhel_eus:8.1::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
`nodejs-debugsource` Red Hat:rhel_eus:8.1::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
`nodejs-devel` Red Hat:rhel_eus:8.1::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
`nodejs-docs` Red Hat:rhel_eus:8.1::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
`nodejs-full-i18n` Red Hat:rhel_eus:8.1::appstream From an advisory covering 11 CVEs	before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
`nodejs-nodemon` Red Hat:rhel_eus:8.1::appstream From an advisory covering 11 CVEs	before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45	0:1.18.3-1.module+el8.1.0+3369+37ae6a45
`nodejs-packaging` Red Hat:rhel_eus:8.1::appstream From an advisory covering 11 CVEs	before 0:17-3.module+el8.1.0+3369+37ae6a45	0:17-3.module+el8.1.0+3369+37ae6a45
`npm` Red Hat:rhel_eus:8.1::appstream From an advisory covering 11 CVEs	before 1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec	1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec
`nodejs` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:14.17.5-1.module+el8.4.0+12247+e2879e58	1:14.17.5-1.module+el8.4.0+12247+e2879e58
`nodejs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:14.17.5-1.module+el8.4.0+12247+e2879e58	1:14.17.5-1.module+el8.4.0+12247+e2879e58
`nodejs-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:14.17.5-1.module+el8.4.0+12247+e2879e58	1:14.17.5-1.module+el8.4.0+12247+e2879e58
`nodejs-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:14.17.5-1.module+el8.4.0+12247+e2879e58	1:14.17.5-1.module+el8.4.0+12247+e2879e58
`nodejs-docs` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:14.17.5-1.module+el8.4.0+12247+e2879e58	1:14.17.5-1.module+el8.4.0+12247+e2879e58
`nodejs-full-i18n` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:14.17.5-1.module+el8.4.0+12247+e2879e58	1:14.17.5-1.module+el8.4.0+12247+e2879e58
`nodejs-nodemon` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 0:2.0.3-1.module+el8.3.0+6519+9f98ed83	0:2.0.3-1.module+el8.3.0+6519+9f98ed83
`nodejs-packaging` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 0:23-3.module+el8.3.0+6519+9f98ed83	0:23-3.module+el8.3.0+6519+9f98ed83
`npm` Red Hat:enterprise_linux:8::appstream From an advisory covering 8 CVEs	before 1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58	1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58
`nodejs` Rocky Linux:8 From an advisory covering 8 CVEs	before 1:12.22.5-1.module+el8.4.0+647+e905fa21	1:12.22.5-1.module+el8.4.0+647+e905fa21
`nodejs-nodemon` Rocky Linux:8 From an advisory covering 8 CVEs	before 0:2.0.3-1.module+el8.6.0+982+9fdca2d4	0:2.0.3-1.module+el8.6.0+982+9fdca2d4
`nodejs-nodemon` Rocky Linux:8 From an advisory covering 8 CVEs	before 0:2.0.3-1.module+el8.3.0+100+234774f7	0:2.0.3-1.module+el8.3.0+100+234774f7
`nodejs-nodemon` Rocky Linux:8 From an advisory covering 8 CVEs	before 0:2.0.3-1.module+el8.4.0+638+5344c6f7	0:2.0.3-1.module+el8.4.0+638+5344c6f7
`nodejs-packaging` Rocky Linux:8 From an advisory covering 8 CVEs	before 0:17-3.module+el8.3.0+101+f84c7154	0:17-3.module+el8.3.0+101+f84c7154
`nodejs` Rocky Linux:8 From an advisory covering 8 CVEs	before 1:14.17.5-1.module+el8.4.0+654+17ff1d38	1:14.17.5-1.module+el8.4.0+654+17ff1d38
`nodejs-packaging` Rocky Linux:8 From an advisory covering 8 CVEs	before 0:23-3.module+el8.7.0+1071+4bdda2a8	0:23-3.module+el8.7.0+1071+4bdda2a8
`nodejs-packaging` Rocky Linux:8 From an advisory covering 8 CVEs	before 0:23-3.module+el8.3.0+100+234774f7	0:23-3.module+el8.3.0+100+234774f7
`nodejs-packaging` Rocky Linux:8 From an advisory covering 8 CVEs	before 0:23-3.module+el8.5.0+733+de4fee6c	0:23-3.module+el8.5.0+733+de4fee6c
`nodejs12` SUSE:Linux Enterprise Module for Web and Scripting 12 From an advisory covering 5 CVEs	before 12.22.5-1.35.1	12.22.5-1.35.1
`nodejs12` SUSE:Linux Enterprise Module for Web and Scripting 15 SP2 From an advisory covering 5 CVEs	before 12.22.5-4.19.1	12.22.5-4.19.1
`nodejs12` SUSE:Linux Enterprise Module for Web and Scripting 15 SP3 From an advisory covering 5 CVEs	before 12.22.5-4.19.1	12.22.5-4.19.1
`nodejs14` SUSE:Linux Enterprise Module for Web and Scripting 12 From an advisory covering 5 CVEs	before 14.17.5-6.15.3	14.17.5-6.15.3
`nodejs14` SUSE:Linux Enterprise Module for Web and Scripting 15 SP2 From an advisory covering 5 CVEs	before 14.17.5-5.15.5	14.17.5-5.15.5
`nodejs14` SUSE:Linux Enterprise Module for Web and Scripting 15 SP3 From an advisory covering 5 CVEs	before 14.17.5-5.15.5	14.17.5-5.15.5
`nodejs10` SUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise Server 15-LTSS From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise Server 15 SP2-BCL From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Manager Proxy 4.1 From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Manager Retail Branch Server 4.1 From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Manager Server 4.1 From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Enterprise Storage 6 From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` SUSE:Enterprise Storage 7 From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` openSUSE:Leap 15.3 From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs10` openSUSE:Leap 15.4 From an advisory covering 8 CVEs	before 10.24.1-150000.1.47.1	10.24.1-150000.1.47.1
`nodejs12` openSUSE:Leap 15.2 From an advisory covering 5 CVEs	before 12.22.5-lp152.3.18.1	12.22.5-lp152.3.18.1
`nodejs14` openSUSE:Leap 15.2 From an advisory covering 5 CVEs	before 14.17.5-lp152.14.1	14.17.5-lp152.14.1
`nodejs12` openSUSE:Leap 15.3 From an advisory covering 5 CVEs	before 12.22.5-4.19.1	12.22.5-4.19.1
`nodejs14` openSUSE:Leap 15.3 From an advisory covering 5 CVEs	before 14.17.5-5.15.5	14.17.5-5.15.5
`nodejs14` openSUSE:Tumbleweed From an advisory covering 19 CVEs	before 14.17.5-1.2	14.17.5-1.2
`nodejs16` openSUSE:Tumbleweed From an advisory covering 5 CVEs	before 16.6.2-2.2	16.6.2-2.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-22940 is a high vulnerability (CVSS 7.5) in Nodejs Node, published August 16, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.9%, the 96th percentile. Fixed in nodejs 16.14.0-1.

References

Show 154 moreShow less