{"id":"CVE-2021-22940","aliases":["ALSA-2021:3623","ALSA-2021:3666","AZL-6745","BIT-node-2021-22940","BIT-node-min-2021-22940","DEBIAN-CVE-2021-22940","DLA-3137-1","EUVD-2021-10069","GHSA-6hhj-4h22-mrmm","MGASA-2021-0463","RHSA-2021:3280","RHSA-2021:3281","RHSA-2021:3623","RHSA-2021:3638","RHSA-2021:3639","RHSA-2021:3666","RLSA-2021:3623","RLSA-2021:3666","SUSE-SU-2021:2824-1","SUSE-SU-2021:2875-1","SUSE-SU-2021:3184-1","SUSE-SU-2021:3211-1","SUSE-SU-2022:2855-1","UBUNTU-CVE-2021-22940","openSUSE-SU-2021:1214-1","openSUSE-SU-2021:1313-1","openSUSE-SU-2021:2875-1","openSUSE-SU-2021:3211-1","openSUSE-SU-2024:11096-1","openSUSE-SU-2024:11097-1"],"status":"published","title":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an...","description":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.13861,"percentile":0.9656,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2021-08-16T00:00:00Z","modified":"2026-10-29T11:00:46Z","fixes":[{"ecosystem":"Azure Linux:2","package":"nodejs","fixed_in":["16.14.0-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["12.22.5","14.17.5","16.6.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["12.22.5","14.17.5","16.6.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["12.22.5~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["12.22.5~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["12.22.5~dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-1.module_el8.4.0+2521+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.5.0+254+b4526b16"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":8},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.14.0-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.22.5"},{"introduced":"14.0.0"},{"fixed":"14.17.5"},{"introduced":"16.0.0"},{"fixed":"16.6.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0"},{"fixed":"12.22.5"},{"introduced":"14.0.0"},{"fixed":"14.17.5"},{"introduced":"16.0.0"},{"fixed":"16.6.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.0~dfsg-1~deb10u2"}]}],"versions":["10.15.2~dfsg-2","10.15.3~dfsg-1","10.16.3~dfsg-1","10.17.0~dfsg-1","10.17.0~dfsg-2","10.19.0~dfsg-1","10.19.0~dfsg-2","10.19.0~dfsg-3","10.19.0~dfsg1-1","10.20.0~dfsg-1","10.20.1~dfsg-1","10.21.0~dfsg-1","10.21.0~dfsg-1~deb10u1","10.23.1~dfsg-1~deb10u1","10.24.0~dfsg-1~deb10u1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.6-1.mga8"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-5.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.17.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.14-14.17.5.1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.22.5-1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-5.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs12-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.14-12.22.5.1.el7"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+11732+c668cc9f"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.1.0+3369+37ae6a45"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+6519+9f98ed83"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:12.22.5-1.module+el8.4.0+647+e905fa21"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.17.5-1.module+el8.4.0+654+17ff1d38"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.6.0+982+9fdca2d4"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-1.module+el8.4.0+638+5344c6f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+100+234774f7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.5.0+733+de4fee6c"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-1.35.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-4.19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-4.19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-6.15.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-5.15.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-5.15.5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.24.1-150000.1.47.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-lp152.3.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-lp152.14.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.5-4.19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-5.15.5"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.17.5-1.2"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.2-2.2"}]}],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"nextgen_api"},{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"},{"vendor":"oracle","product":"graalvm"},{"vendor":"oracle","product":"jd_edwards_enterpriseone_tools"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"}],"references":[{"url":"https://hackerone.com/reports/1238162","tags":["x_transferred","Permissions Required","Third Party Advisory","advisory","report"]},{"url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/","tags":["x_transferred","Patch","Vendor Advisory","advisory","fix","web","article"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20210923-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202401-02","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22940","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6hhj-4h22-mrmm"},{"url":"https://access.redhat.com/errata/RHSA-2021:3623","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1956818","tags":["report"]},{"url":"https://bugzilla.redhat.com/1988342","tags":["report"]},{"url":"https://bugzilla.redhat.com/1988394","tags":["report"]},{"url":"https://bugzilla.redhat.com/1990409","tags":["report"]},{"url":"https://bugzilla.redhat.com/1990415","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993019","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993029","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993039","tags":["report"]},{"url":"https://bugzilla.redhat.com/1993927","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-3623.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-22930","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22931","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22939","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-22940","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-23343","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32803","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-32804","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3672","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3666","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1993924","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-3666.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-22940","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0463.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29365","tags":["report"]},{"url":"https://nodejs.org/en/blog/release/v14.17.5/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2/","tags":["web"]},{"url":"https://nodejs.org/en/blog/release/v14.17.6/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3280","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1956818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1988394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1990415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993039","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3280.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7788","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7788","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7788","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28469","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28469","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3672","tags":["advisory"]},{"url":"https://c-ares.haxx.se/adv_20210810.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22931","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22939","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22940","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22940","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23343","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32803","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-32804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32804","tags":["advisory"]},{"url":"https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3281","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3281.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993927","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3623.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3638","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1979338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993928","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3638.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-22918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22918","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23362","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-27290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27290","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3639","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993929","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3639.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993924","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3666.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3623","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:3666","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212824-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188881","tags":["report"]},{"url":"https://bugzilla.suse.com/1188917","tags":["report"]},{"url":"https://bugzilla.suse.com/1189368","tags":["report"]},{"url":"https://bugzilla.suse.com/1189369","tags":["report"]},{"url":"https://bugzilla.suse.com/1189370","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3672","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212875-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213184-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213211-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222855-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191601","tags":["report"]},{"url":"https://bugzilla.suse.com/1191602","tags":["report"]},{"url":"https://bugzilla.suse.com/1201325","tags":["report"]},{"url":"https://bugzilla.suse.com/1201326","tags":["report"]},{"url":"https://bugzilla.suse.com/1201327","tags":["report"]},{"url":"https://bugzilla.suse.com/1201328","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32213","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32215","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-22940","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-after-free-on-close-http2-on-stream-canceling-high-cve-2021-22940","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZFSPBU6QGGED7SJWK464GN672ZJB6SMI/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HT3PAHM4M6Q56XJOJVVIZBROY2Y4SUU2/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HHIBOQVFGTSNZKZ3C7TDCN35RIGH22D4/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GAT5MK7257FCSK4EI6CRDFI5ZVBUB5VC/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27290","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-22940","description":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.","status":"published","published":"2021-08-16T00:00:00Z","modified":"2025-04-30T22:24:35.552Z","cwes":["CWE-416"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2021-10069","description":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.","status":"published","published":"2021-08-16T00:00:00Z","modified":"2025-04-30T22:24:35Z","updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-6hhj-4h22-mrmm","title":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an...","description":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.","status":"published","published":"2022-05-24T19:11:13Z","modified":"2024-01-05T12:30:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:55:20.27804Z"}],"nvd":[{"id":"CVE-2021-22940","description":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.","status":"published","published":"2021-08-16T19:15:13.987Z","modified":"2026-06-17T03:38:04.223Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:06:56.943671Z"}],"osv":[{"id":"AZL-6745","title":"CVE-2021-22940 affecting package nodejs for versions less than 16.14.0-1","description":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.","status":"published","published":"2021-08-16T19:15:13Z","modified":"2026-04-21T04:38:10.143972Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"CVE-2021-22940","description":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.","status":"published","published":"2021-08-16T19:15:13.987Z","modified":"2026-10-24T10:30:18.905426775Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-22940","description":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.","status":"published","published":"2021-08-16T19:15:13.987Z","modified":"2026-10-23T18:03:25.149643107Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"RHSA-2021:3280","title":"Red Hat Security Advisory: rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon security update","status":"published","published":"2024-09-13T22:46:18Z","modified":"2026-10-14T10:01:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3281","title":"Red Hat Security Advisory: rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon security update","status":"published","published":"2024-09-13T22:45:36Z","modified":"2026-10-14T10:01:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3623","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:52:49Z","modified":"2026-10-14T10:01:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3638","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:52:56Z","modified":"2026-10-14T10:01:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3639","title":"Red Hat Security Advisory: nodejs:12 security and bug fix update","status":"published","published":"2024-10-21T23:53:03Z","modified":"2026-10-14T10:01:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:3666","title":"Red Hat Security Advisory: nodejs:14 security and bug fix update","status":"published","published":"2024-10-21T23:53:10Z","modified":"2026-10-14T10:01:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:3623","title":"Important: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)","status":"published","published":"2021-09-21T12:33:58Z","modified":"2026-02-05T14:15:09.755984Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2021:3666","title":"Important: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)","status":"published","published":"2021-09-27T06:47:35Z","modified":"2026-02-04T13:45:08.983202Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-22940","description":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.","status":"withdrawn","published":"2021-08-16T19:15:00Z","modified":"2025-07-16T07:42:18.481658Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"ALSA-2021:3623","title":"Important: nodejs:12 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)","status":"published","published":"2021-09-21T12:33:58Z","modified":"2026-10-29T11:00:08.534665993Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2021:3666","title":"Important: nodejs:14 security and bug fix update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)\n\n* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)\n\n* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)\n\n* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)\n\n* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)\n\n* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)\n\n* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)\n\n* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)","status":"published","published":"2021-09-27T06:47:35Z","modified":"2026-10-29T11:00:46.249046474Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-node-2021-22940","description":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.","status":"published","published":"2024-03-06T11:06:08.004Z","modified":"2026-10-16T09:45:20.684581529Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2021-22940","description":"Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.","status":"published","published":"2024-12-16T14:04:54.112Z","modified":"2026-10-16T09:45:28.344570083Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"DLA-3137-1","title":"nodejs - security update","status":"published","published":"2022-10-05T00:00:00Z","modified":"2026-03-09T01:20:02.283973Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2021-0463","title":"Updated nodejs packages fix security vulnerability","description":"Multiple security fixes for nodejs. See references for details\n","status":"published","published":"2021-10-06T19:41:56Z","modified":"2026-04-16T04:41:26.552726206Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1214-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nUpdate to 12.22.5:\n\n- CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-08-31T06:57:55Z","modified":"2026-02-04T02:40:38.620452Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:1313-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917). \n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-09-28T05:11:57Z","modified":"2026-02-04T03:33:01.693628Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2875-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nUpdate to 12.22.5:\n\n- CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)\n","status":"published","published":"2021-08-30T13:55:03Z","modified":"2026-02-04T03:43:27.108814Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3211-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917). \n","status":"published","published":"2021-09-23T14:22:02Z","modified":"2026-02-04T03:27:58.800857Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11096-1","title":"nodejs14-14.17.5-1.2 on GA media","description":"These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:56.833198Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11097-1","title":"nodejs16-16.6.2-2.2 on GA media","description":"These are all security issues fixed in the nodejs16-16.6.2-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:23:44.425283Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:2824-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nUpdate to 12.22.5:\n\n- CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)\n","status":"published","published":"2021-08-24T13:14:03Z","modified":"2026-02-04T02:55:59.914246Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2875-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nUpdate to 12.22.5:\n\n- CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (bsc#1189370, bsc#1188881)\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: http2: fixes use after free on close http2 on stream canceling (bsc#1188917)\n","status":"published","published":"2021-08-30T13:55:02Z","modified":"2026-02-04T02:57:23.769682Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3184-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).\n","status":"published","published":"2021-09-22T11:06:01Z","modified":"2026-02-04T03:48:42.95675Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3211-1","title":"Security update for nodejs14","description":"This update for nodejs14 fixes the following issues:\n\n- CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).\n- CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).\n- CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)\n- CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)\n- CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917). \n","status":"published","published":"2021-09-23T14:22:00Z","modified":"2026-02-04T02:20:52.858915Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2022:2855-1","title":"Security update for nodejs10","description":"This update for nodejs10 fixes the following issues:\n\n- CVE-2021-22930, CVE-2021-22940: Fixed two memory corruption issues\n  during HTTP/2 stream cancellation (bsc#1188917, bsc#1189368).\n- CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2021-22960,\n  CVE-2021-22959: Fixed multiple HTTP request smuggling issues in\n  the underlying HTTP parser (bsc#1201325, bsc#1201326, bsc#1201327, \n  bsc#1191602, bsc#1191601).\n- CVE-2022-32212: Fixed a DNS rebinding issue caused by improper IPv4\n  validation (bsc#1201328).\n","status":"published","published":"2022-08-19T14:08:24Z","modified":"2026-02-04T02:56:07.566841Z","updated_at":"2026-11-02T15:53:50.965375Z"}]}}