{"id":"CVE-2021-22931","aliases":["ALPINE-CVE-2021-22931","ALSA-2021:3623","ALSA-2021:3666","AZL-32282","AZL-6743","BELL-CVE-2021-22931","BIT-node-2021-22931","BIT-node-min-2021-22931","EUVD-2021-10060","GHSA-7r9p-c88x-w357","MGASA-2021-0463","RHSA-2021:3280","RHSA-2021:3281","RHSA-2021:3623","RHSA-2021:3638","RHSA-2021:3639","RHSA-2021:3666","RLSA-2021:3623","RLSA-2021:3666","SUSE-SU-2021:2823-1","SUSE-SU-2021:2824-1","SUSE-SU-2021:2875-1","SUSE-SU-2021:2953-1","SUSE-SU-2021:3184-1","SUSE-SU-2021:3211-1","UBUNTU-CVE-2021-22931","openSUSE-SU-2021:1214-1","openSUSE-SU-2021:1239-1","openSUSE-SU-2021:1313-1","openSUSE-SU-2021:2875-1","openSUSE-SU-2021:2953-1","openSUSE-SU-2021:3211-1"],"status":"published","title":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS,...","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.21952,"percentile":0.97687,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-170","CWE-20"],"published":"2021-08-16T00:00:00Z","modified":"2026-11-03T06:32:31Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"nodejs","fixed_in":["12.22.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs","fixed_in":["12.22.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["14.17.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs-current","fixed_in":["16.11.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs-current","fixed_in":["16.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs-current","fixed_in":["16.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs-current","fixed_in":["16.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs-current","fixed_in":["16.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs-current","fixed_in":["16.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs-current","fixed_in":["16.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs-current","fixed_in":["16.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs-current","fixed_in":["16.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs-current","fixed_in":["16.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["16.6.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"python-gevent","fixed_in":["21.1.2-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nodejs","fixed_in":["16.14.0-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["12.12.1","12.22.5","14.14.1","14.17.5","16.6.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["12.12.1","12.22.5","14.14.1","14.17.5","16.6.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.11.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+254+b4526b16"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":8},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-gevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.2-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.14.0-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.12.1"},{"introduced":"12.13.0"},{"fixed":"12.22.5"},{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.15.0"},{"fixed":"14.17.5"},{"introduced":"16.0.0"},{"fixed":"16.6.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.12.1"},{"introduced":"12.13.0"},{"fixed":"12.22.5"},{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.15.0"},{"fixed":"14.17.5"},{"introduced":"16.0.0"},{"fixed":"16.6.2"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.6-1.mga8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-5.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.14-14.17.5.1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-5.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.14-12.22.5.1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+11732+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+6519+9f98ed83"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+647+e905fa21"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+654+17ff1d38"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.42.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-1.35.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-4.19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-4.19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.39.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-6.15.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-5.15.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-5.15.5"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-lp152.3.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-lp152.2.18.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-lp152.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-4.19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-1.39.2"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-5.15.5"}]}],"bundled":5}],"products":[{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"nextgen_api"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"snapcenter"},{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"},{"vendor":"oracle","product":"graalvm"},{"vendor":"oracle","product":"mysql_cluster"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/","tags":["x_transferred","Patch","Vendor Advisory","advisory","fix","web","article","report"]},{"url":"https://hackerone.com/reports/1178337","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20210923-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20211022-0003/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202401-02","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22931","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-7r9p-c88x-w357"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-22931","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3623","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1956818","tags":["report"]},{"url":"https://bugzilla.redhat.com/1988342","tags":["report"]},{"url":"https://bugzilla.redhat.com/1988394","tags":["report"]},{"url":"https://bugzilla.redhat.com/1990409","tags":["report"]},{"url":"https://bugzilla.redhat.com/1990415","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993019","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993029","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993039","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993927","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-3623.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-22930","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22931","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22939","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22940","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-23343","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32803","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32804","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3672","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3666","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1993924","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-3666.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-22931","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0463.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29365","tags":["report"]},{"url":"https://nodejs.org/en/blog/release/v14.17.5/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v14.17.6/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3280","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993039","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3280.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28469","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28469","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3672","tags":["advisory"]},{"url":"https://c-ares.haxx.se/adv_20210810.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22931","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22940","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22940","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23343","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32803","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32804","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3281","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3281.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993927","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3623.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3638","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993928","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3638.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22918","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23362","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27290","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3639","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993929","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3639.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993924","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3666.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3623","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3666","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212823-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188881","tags":["report"]},{"url":"https://bugzilla.suse.com/1188917","tags":["report"]},{"url":"https://bugzilla.suse.com/1189369","tags":["report"]},{"url":"https://bugzilla.suse.com/1189370","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3672","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212824-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189368","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22940","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212875-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212953-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213184-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213211-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-22931","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#cares-upgrade-improper-handling-of-untypical-characters-in-domain-names-high-cve-2021-22931","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZFSPBU6QGGED7SJWK464GN672ZJB6SMI/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XVSODU3IBFQTSXJDK3YGWSPCAZNRBOB3/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HT3PAHM4M6Q56XJOJVVIZBROY2Y4SUU2/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HHIBOQVFGTSNZKZ3C7TDCN35RIGH22D4/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DA3KJWR2C3T5FTDAXOSTUOQOJZTKFSKF/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAT5MK7257FCSK4EI6CRDFI5ZVBUB5VC/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-22931","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","status":"published","published":"2021-08-16T00:00:00Z","modified":"2025-04-30T22:24:34.672Z","cwes":["CWE-170"],"updated_at":"2026-11-02T14:32:58.028461Z"}],"euvd":[{"id":"EUVD-2021-10060","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","status":"published","published":"2021-08-16T00:00:00Z","modified":"2025-04-30T22:24:34Z","updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-7r9p-c88x-w357","title":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS,...","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","status":"published","published":"2022-05-24T19:11:14Z","modified":"2024-01-05T12:30:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-170"],"updated_at":"2026-11-02T14:55:20.27804Z"}],"nvd":[{"id":"CVE-2021-22931","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","status":"published","published":"2021-08-16T19:15:13.127Z","modified":"2026-06-17T03:38:03.25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-170","CWE-20"],"updated_at":"2026-11-02T14:06:56.943671Z"}],"osv":[{"id":"ALPINE-CVE-2021-22931","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","status":"published","published":"2021-08-16T19:15:13.127Z","modified":"2026-11-03T06:32:31.867867208Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"AZL-32282","title":"CVE-2021-22931 affecting package python-gevent for versions less than 21.1.2-3","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","status":"published","published":"2021-08-16T19:15:13Z","modified":"2026-04-21T04:26:45.577886Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-6743","title":"CVE-2021-22931 affecting package nodejs for versions less than 16.14.0-1","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","status":"published","published":"2021-08-16T19:15:13Z","modified":"2026-04-21T04:38:09.857026Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"BELL-CVE-2021-22931","title":"CVE-2021-22931 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:28.680929Z","modified":"2026-02-18T07:38:25.0416Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-22931","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","status":"published","published":"2021-08-16T19:15:13.127Z","modified":"2026-10-24T10:30:23.877179625Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"RHSA-2021:3280","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","status":"published","published":"2024-09-13T22:46:18Z","modified":"2026-10-14T10:01:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3281","title":"Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update","status":"published","published":"2024-09-13T22:45:36Z","modified":"2026-10-14T10:01:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3623","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:52:49Z","modified":"2026-10-14T10:01:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3638","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:52:56Z","modified":"2026-10-14T10:01:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3639","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:53:03Z","modified":"2026-10-14T10:01:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3666","title":"Red Hat Security Advisory: nodejs:14 security and bug fix update","status":"published","published":"2024-10-21T23:53:10Z","modified":"2026-10-14T10:01:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:3623","title":"Important: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)","status":"published","published":"2021-09-21T12:33:58Z","modified":"2026-02-05T14:15:09.755984Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:3666","title":"Important: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)","status":"published","published":"2021-09-27T06:47:35Z","modified":"2026-02-04T13:45:08.983202Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-22931","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","status":"withdrawn","published":"2021-08-16T19:15:00Z","modified":"2025-07-16T08:15:31.885556Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"ALSA-2021:3623","title":"Important: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)","status":"published","published":"2021-09-21T12:33:58Z","modified":"2026-10-29T11:00:08.534665993Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:3666","title":"Important: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)","status":"published","published":"2021-09-27T06:47:35Z","modified":"2026-10-29T11:00:46.249046474Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-node-2021-22931","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","status":"published","published":"2024-03-06T11:06:25.708Z","modified":"2026-10-16T09:45:19.997527797Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2021-22931","description":"Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.","status":"published","published":"2024-12-16T14:05:15.223Z","modified":"2026-10-16T09:45:28.567319916Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"MGASA-2021-0463","title":"Updated nodejs packages fix security vulnerability","description":"Multiple security fixes for nodejs. See references for details\n","status":"published","published":"2021-10-06T19:41:56Z","modified":"2026-04-16T04:41:26.552726206Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1214-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nUpdate to 12.22.5:\n\n- CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-08-31T06:57:55Z","modified":"2026-02-04T02:40:38.620452Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1239-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).\n- CVE-2021-22939: Fixed incomplete validation of rejectUnauthorized parameter (bsc#1189369).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-09-07T10:06:06Z","modified":"2025-05-07T18:12:31.599655Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1313-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917). \n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-09-28T05:11:57Z","modified":"2026-02-04T03:33:01.693628Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2875-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nUpdate to 12.22.5:\n\n- CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)\n","status":"published","published":"2021-08-30T13:55:03Z","modified":"2026-02-04T03:43:27.108814Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2953-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).\n- CVE-2021-22939: Fixed incomplete validation of rejectUnauthorized parameter (bsc#1189369).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n","status":"published","published":"2021-09-03T12:41:24Z","modified":"2026-02-04T02:36:27.434309Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3211-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917). \n","status":"published","published":"2021-09-23T14:22:02Z","modified":"2026-02-04T03:27:58.800857Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:2823-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).\n- CVE-2021-22939: Fixed incomplete validation of rejectUnauthorized parameter (bsc#1189369).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n","status":"published","published":"2021-08-24T13:12:49Z","modified":"2026-02-04T02:56:05.125681Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2824-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nUpdate to 12.22.5:\n\n- CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)\n","status":"published","published":"2021-08-24T13:14:03Z","modified":"2026-02-04T02:55:59.914246Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2875-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nUpdate to 12.22.5:\n\n- CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)\n","status":"published","published":"2021-08-30T13:55:02Z","modified":"2026-02-04T02:57:23.769682Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2953-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).\n- CVE-2021-22939: Fixed incomplete validation of rejectUnauthorized parameter (bsc#1189369).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n","status":"published","published":"2021-09-03T12:41:19Z","modified":"2026-02-04T02:27:29.389209Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3184-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).\n","status":"published","published":"2021-09-22T11:06:01Z","modified":"2026-02-04T03:48:42.95675Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3211-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917). \n","status":"published","published":"2021-09-23T14:22:00Z","modified":"2026-02-04T02:20:52.858915Z","updated_at":"2026-11-02T15:53:49.605187Z"}]}}