Every CVE Search/ Get API key

CVE-2021-22918

Out-of-Bounds Read in Node.js

5.3 MediumFix available

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

23.1%Up 22.5 points since Jul 13, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Record
CVE-2021-22918
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Record
CVE-2021-22918
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2021-10047 No score

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Record
EUVD-2021-10047
Updated
2026-11-02
GitHub AdvisoriesGHSA-x3cj-3539-rcpx 8.2

Out-of-Bounds Read in Node.js

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Record
GHSA-x3cj-3539-rcpx
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2021-22918 5.3

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Record
ALPINE-CVE-2021-22918
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVAZL-41581 5.3

CVE-2021-22918 affecting package pytorch for versions less than 2.2.2-4

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Record
AZL-41581
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 37 moreShow less
OSV 5.3

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Record
CVE-2021-22918
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-22918 5.3

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Record
DEBIAN-CVE-2021-22918
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVOESA-2021-1291 5.3

nodejs security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().(CVE-2021-22918)

Record
OESA-2021-1291
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVOESA-2022-1933 5.3

nodejs security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().(CVE-2021-22918)

Record
OESA-2022-1933
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2021:2931 7.5

Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update

Record
RHSA-2021:2931
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:2932 7.5

Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update

Record
RHSA-2021:2932
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:3073 7.5

Red Hat Security Advisory: nodejs:12 security, bug fix, and enhancement update

Record
RHSA-2021:3073
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:3074 7.5

Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update

Record
RHSA-2021:3074
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:3075 5.3

Red Hat Security Advisory: libuv security update

Record
RHSA-2021:3075
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2021:3638 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2021:3638
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3639 9.8

Red Hat Security Advisory: nodejs:12 security and bug fix update

Record
RHSA-2021:3639
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:3073 7.5

Moderate: nodejs:12 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.22.3). (BZ#1978201)

Security Fix(es):

  • nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)

  • nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)

  • libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:3073
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2021:3074 7.5

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.17.3). (BZ#1978203)

Security Fix(es):

  • nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)

  • nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)

  • libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:3074
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2021:3075 5.3

Low: libuv security update

libuv is a multi-platform support library with a focus on asynchronous I/O.

Security Fix(es):

  • libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:3075
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-22918 5.3

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Record
UBUNTU-CVE-2021-22918
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVALSA-2021:3073 No score

Moderate: nodejs:12 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (12.22.3). (BZ#1978201)

Security Fix(es):

  • nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)

  • nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)

  • libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:3073
Updated
2026-11-02
OSVALSA-2021:3074 No score

Moderate: nodejs:14 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.17.3). (BZ#1978203)

Security Fix(es):

  • nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() (CVE-2021-23362)

  • nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)

  • libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:3074
Updated
2026-11-02
OSVALSA-2021:3075 No score

Low: libuv security update

libuv is a multi-platform support library with a focus on asynchronous I/O.

Security Fix(es):

  • libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes (CVE-2021-22918)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:3075
Updated
2026-11-02
OSVBIT-node-2021-22918 No score

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Record
BIT-node-2021-22918
Updated
2026-11-02
OSVBIT-node-min-2021-22918 No score

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Record
BIT-node-min-2021-22918
Updated
2026-11-02
OSVMGASA-2021-0360 No score

Updated libuv packages fix security vulnerability

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo(). (CVE-2021-22918).

Record
MGASA-2021-0360
Updated
2026-11-02
OSVopenSUSE-SU-2021:1059-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • update to 12.22.2:
  • CVE-2021-22918: Out of bounds read (bsc#1187973)
  • CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
  • CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1059-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1060-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1060-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:1061-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • reduce memory footprint of test-worker-stdio (bsc#1183155)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:1061-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2327-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • update to 12.22.2:
  • CVE-2021-22918: Out of bounds read (bsc#1187973)
  • CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
  • CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)
Record
openSUSE-SU-2021:2327-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2353-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • reduce memory footprint of test-worker-stdio (bsc#1183155)
Record
openSUSE-SU-2021:2353-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2354-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
Record
openSUSE-SU-2021:2354-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11007-1 No score

libuv-devel-1.42.0-1.2 on GA media

These are all security issues fixed in the libuv-devel-1.42.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11007-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11096-1 No score

nodejs14-14.17.5-1.2 on GA media

These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11096-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11097-1 No score

nodejs16-16.6.2-2.2 on GA media

These are all security issues fixed in the nodejs16-16.6.2-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11097-1
Updated
2026-11-02
OSVSUSE-SU-2021:2319-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
Record
SUSE-SU-2021:2319-1
Updated
2026-11-02
OSVSUSE-SU-2021:2323-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
Record
SUSE-SU-2021:2323-1
Updated
2026-11-02
OSVSUSE-SU-2021:2326-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • update to 12.22.2:
  • CVE-2021-22918: Out of bounds read (bsc#1187973)
  • CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
  • CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)
Record
SUSE-SU-2021:2326-1
Updated
2026-11-02
OSVSUSE-SU-2021:2327-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • update to 12.22.2:
  • CVE-2021-22918: Out of bounds read (bsc#1187973)
  • CVE-2021-23362: ssri Regular Expression Denial of Service and hosted-git-info (bsc#1187977)
  • CVE-2021-27290: Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • CVE-2020-7774: npm - Update y18n to fix Prototype-Pollution (bsc#1184450)
Record
SUSE-SU-2021:2327-1
Updated
2026-11-02
OSVSUSE-SU-2021:2353-1 No score

Security update for nodejs10

This update for nodejs10 fixes the following issues:

Update nodejs10 to 10.24.1.

Including fixes for

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
  • CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (bsc#1183851)
  • CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (bsc#1183852)
  • reduce memory footprint of test-worker-stdio (bsc#1183155)
Record
SUSE-SU-2021:2353-1
Updated
2026-11-02
OSVSUSE-SU-2021:2354-1 No score

Security update for nodejs14

This update for nodejs14 fixes the following issues:

Update nodejs14 to 14.17.2.

Including fixes for:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (bsc#1187973)
  • CVE-2021-27290: ssri Regular Expression Denial of Service (bsc#1187976)
  • CVE-2021-23362: hosted-git-info Regular Expression Denial of Service (bsc#1187977)
  • CVE-2020-7774: y18n Prototype Pollution (bsc#1184450)
Record
SUSE-SU-2021:2354-1
Updated
2026-11-02
OSVUSN-5007-1 No score

libuv1 vulnerability

Eric Sesterhenn discovered that libuv incorrectly handled certain strings. An attacker could possibly use this issue to access sensitive information or cause a crash.

Record
USN-5007-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.11
 before 12.22.2-r0
12.22.2-r0
nodejs
Alpine:v3.12
 before 12.22.2-r0
12.22.2-r0
nodejs
Alpine:v3.13
 before 14.17.3-r0
14.17.3-r0
nodejs
Alpine:v3.14
 before 14.17.3-r0
14.17.3-r0
nodejs-nodemon
AlmaLinux:8
 before 2.0.3-1.module_el8.4.0+2521+c668cc9f
2.0.3-1.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
nodejs-packaging
AlmaLinux:8
 before 23-3.module_el8.5.0+254+b4526b16
23-3.module_el8.5.0+254+b4526b16
nodejs-packaging
AlmaLinux:8
 before 23-3.module_el8.4.0+2522+3bd42762
23-3.module_el8.4.0+2522+3bd42762
Show 107 moreShow less
Affected packages
PackageAffectedFixed
libuv
AlmaLinux:8
 before 1:1.41.1-1.el8_4
1:1.41.1-1.el8_4
libuv-devel
AlmaLinux:8
 before 1:1.41.1-1.el8_4
1:1.41.1-1.el8_4
pytorch
Azure Linux:3
 before 2.2.2-4
2.2.2-4
node
Bitnami
 12.0.0 up to 12.22.2, 14.0.0 up to 14.17.2, 16.0.0 up to 16.4.1
12.22.214.17.216.4.1
node-min
Bitnami
 12.0.0 up to 12.22.2, 14.0.0 up to 14.17.2, 16.0.0 up to 16.4.1
12.22.214.17.216.4.1
libuv1
Debian:12
 before 1.40.0-2
1.40.0-2
libuv1
Debian:13
 before 1.40.0-2
1.40.0-2
libuv1
Debian:14
 before 1.40.0-2
1.40.0-2
libuv1
Debian:10
 before 1.24.1-1+deb10u1, plus listed versions
1.24.1-1
1.24.1-1+deb10u1
libuv
Mageia:8
 before 1.40.0-1.1.mga8
1.40.0-1.1.mga8
nodejs
openEuler:20.03-LTS-SP2
 before 10.21.0-8.oe1
10.21.0-8.oe1
nodejs
openEuler:20.03-LTS-SP1
 before 12.22.11-1.oe1
12.22.11-1.oe1
rh-nodejs12-nodejs
Red Hat:rhel_software_collections:3::el7
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-devel
Red Hat:rhel_software_collections:3::el7
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-docs
Red Hat:rhel_software_collections:3::el7
 before 0:12.22.2-1.el7
0:12.22.2-1.el7
rh-nodejs12-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
 before 0:2.0.3-2.el7
0:2.0.3-2.el7
rh-nodejs12-npm
Red Hat:rhel_software_collections:3::el7
 before 0:6.14.13-12.22.2.1.el7
0:6.14.13-12.22.2.1.el7
rh-nodejs14-nodejs
Red Hat:rhel_software_collections:3::el7
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-debuginfo
Red Hat:rhel_software_collections:3::el7
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-devel
Red Hat:rhel_software_collections:3::el7
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-docs
Red Hat:rhel_software_collections:3::el7
 before 0:14.17.2-1.el7
0:14.17.2-1.el7
rh-nodejs14-nodejs-nodemon
Red Hat:rhel_software_collections:3::el7
 before 0:2.0.3-2.el7
0:2.0.3-2.el7
rh-nodejs14-npm
Red Hat:rhel_software_collections:3::el7
 before 0:6.14.13-14.17.2.1.el7
0:6.14.13-14.17.2.1.el7
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:12.22.3-2.module+el8.4.0+11732+c668cc9f
1:12.22.3-2.module+el8.4.0+11732+c668cc9f
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.3-1.module+el8.4.0+11732+c668cc9f
0:2.0.3-1.module+el8.4.0+11732+c668cc9f
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:enterprise_linux:8::appstream
 before 1:6.14.13-1.12.22.3.2.module+el8.4.0+11732+c668cc9f
1:6.14.13-1.12.22.3.2.module+el8.4.0+11732+c668cc9f
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:14.17.3-2.module+el8.4.0+11738+3bd42762
1:14.17.3-2.module+el8.4.0+11738+3bd42762
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.3-1.module+el8.3.0+6519+9f98ed83
0:2.0.3-1.module+el8.3.0+6519+9f98ed83
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:23-3.module+el8.3.0+6519+9f98ed83
0:23-3.module+el8.3.0+6519+9f98ed83
npm
Red Hat:enterprise_linux:8::appstream
 before 1:6.14.13-1.14.17.3.2.module+el8.4.0+11738+3bd42762
1:6.14.13-1.14.17.3.2.module+el8.4.0+11738+3bd42762
libuv
Red Hat:enterprise_linux:8::appstream
 before 1:1.41.1-1.el8_4
1:1.41.1-1.el8_4
libuv-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:1.41.1-1.el8_4
1:1.41.1-1.el8_4
libuv-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:1.41.1-1.el8_4
1:1.41.1-1.el8_4
libuv-debuginfo
Red Hat:enterprise_linux:8::crb
 before 1:1.41.1-1.el8_4
1:1.41.1-1.el8_4
libuv-debugsource
Red Hat:enterprise_linux:8::crb
 before 1:1.41.1-1.el8_4
1:1.41.1-1.el8_4
libuv-devel
Red Hat:enterprise_linux:8::crb
 before 1:1.41.1-1.el8_4
1:1.41.1-1.el8_4
nodejs
Red Hat:rhel_eus:8.2::appstream
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-debugsource
Red Hat:rhel_eus:8.2::appstream
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-devel
Red Hat:rhel_eus:8.2::appstream
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-docs
Red Hat:rhel_eus:8.2::appstream
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-full-i18n
Red Hat:rhel_eus:8.2::appstream
 before 1:12.22.5-1.module+el8.2.0+12241+a3db445b
1:12.22.5-1.module+el8.2.0+12241+a3db445b
nodejs-nodemon
Red Hat:rhel_eus:8.2::appstream
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_eus:8.2::appstream
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.2::appstream
 before 1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b
1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b
nodejs
Red Hat:rhel_eus:8.1::appstream
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-debugsource
Red Hat:rhel_eus:8.1::appstream
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-devel
Red Hat:rhel_eus:8.1::appstream
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-docs
Red Hat:rhel_eus:8.1::appstream
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-full-i18n
Red Hat:rhel_eus:8.1::appstream
 before 1:12.22.5-1.module+el8.1.0+12238+63fe3aec
1:12.22.5-1.module+el8.1.0+12238+63fe3aec
nodejs-nodemon
Red Hat:rhel_eus:8.1::appstream
 before 0:1.18.3-1.module+el8.1.0+3369+37ae6a45
0:1.18.3-1.module+el8.1.0+3369+37ae6a45
nodejs-packaging
Red Hat:rhel_eus:8.1::appstream
 before 0:17-3.module+el8.1.0+3369+37ae6a45
0:17-3.module+el8.1.0+3369+37ae6a45
npm
Red Hat:rhel_eus:8.1::appstream
 before 1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec
1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec
nodejs
Rocky Linux:8
 before 1:12.22.3-2.module+el8.4.0+638+5344c6f7
1:12.22.3-2.module+el8.4.0+638+5344c6f7
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.3-1.module+el8.6.0+982+9fdca2d4
0:2.0.3-1.module+el8.6.0+982+9fdca2d4
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.3-1.module+el8.3.0+100+234774f7
0:2.0.3-1.module+el8.3.0+100+234774f7
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.3-1.module+el8.4.0+638+5344c6f7
0:2.0.3-1.module+el8.4.0+638+5344c6f7
nodejs-packaging
Rocky Linux:8
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
nodejs
Rocky Linux:8
 before 1:14.17.3-2.module+el8.4.0+639+18660d0d
1:14.17.3-2.module+el8.4.0+639+18660d0d
nodejs-packaging
Rocky Linux:8
 before 0:23-3.module+el8.7.0+1071+4bdda2a8
0:23-3.module+el8.7.0+1071+4bdda2a8
nodejs-packaging
Rocky Linux:8
 before 0:23-3.module+el8.3.0+100+234774f7
0:23-3.module+el8.3.0+100+234774f7
nodejs-packaging
Rocky Linux:8
 before 0:23-3.module+el8.5.0+733+de4fee6c
0:23-3.module+el8.5.0+733+de4fee6c
libuv
Rocky Linux:8
 before 1:1.41.1-1.el8_4
1:1.41.1-1.el8_4
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 14.17.2-6.12.1
14.17.2-6.12.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 10.24.1-1.39.1
10.24.1-1.39.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 12.22.2-1.32.1
12.22.2-1.32.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
 before 12.22.2-4.16.1
12.22.2-4.16.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
 before 12.22.2-4.16.1
12.22.2-4.16.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise Server 15-LTSS
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Manager Proxy 4.0
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Manager Retail Branch Server 4.0
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Manager Server 4.0
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs10
SUSE:Enterprise Storage 6
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2
 before 14.17.2-5.12.1
14.17.2-5.12.1
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
 before 14.17.2-5.12.1
14.17.2-5.12.1
libuv1
Ubuntu:20.04:LTS
 before 1.34.2-1ubuntu1.3, plus listed versions
1.30.1-11.33.1-21.33.1-2ubuntu21.33.1-3ubuntu11.34.2-1ubuntu11.34.2-1ubuntu1.1
1.34.2-1ubuntu1.3
nodejs12
openSUSE:Leap 15.2
 before 12.22.2-lp152.3.15.1
12.22.2-lp152.3.15.1
nodejs14
openSUSE:Leap 15.2
 before 14.17.2-lp152.11.1
14.17.2-lp152.11.1
nodejs10
openSUSE:Leap 15.2
 before 10.24.1-lp152.2.15.1
10.24.1-lp152.2.15.1
nodejs12
openSUSE:Leap 15.3
 before 12.22.2-4.16.1
12.22.2-4.16.1
nodejs10
openSUSE:Leap 15.3
 before 10.24.1-1.36.1
10.24.1-1.36.1
nodejs14
openSUSE:Leap 15.3
 before 14.17.2-5.12.1
14.17.2-5.12.1
libuv
openSUSE:Tumbleweed
 before 1.42.0-1.2
1.42.0-1.2
nodejs14
openSUSE:Tumbleweed
 before 14.17.5-1.2
14.17.5-1.2
nodejs16
openSUSE:Tumbleweed
 before 16.6.2-2.2
16.6.2-2.2

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-22918 is a medium vulnerability (CVSS 5.3) in Nodejs Node, published July 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 23.1%, the 97th percentile. Fixed in nodejs 12.22.2-r0.

References

Show 132 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open