What’s Vulnerable › Vulnerabilities
CVE-2021-22883
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 77.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-03-03 · updated 2026-06-17
- Weakness: CWE-400
Description
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
Affected products
- Fedoraproject Fedora: 32, 33, 34
- NetApp E-Series Performance Analyzer: all versions
- Node.js: from 10.0.0 before 10.24.0; from 12.0.0 before 12.21.0; from 14.0.0 before 14.16.0; from 15.0.0 before 15.10.0 — fixed in 10.24.0, 12.21.0, 14.16.0, 15.10.0
- Oracle Corporation GraalVM Enterprise Edition: 19.3.5, 20.3.1.2, 21.0.0.2
- Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.6.0 — fixed in 9.2.6.0
- Oracle Corporation MySQL Cluster: through 8.0.25
- Oracle Nosql Database: before 20.3 — fixed in 20.3
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
How to fix
Upgrade to a fixed version: Node.js 10.24.0, 12.21.0, 14.16.0, 15.10.0; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.6.0; Oracle Nosql Database 20.3; Siemens Sinec Infrastructure Network Services 1.0.1.1. Check the vendor advisory for mitigations.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1043360
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7XIJQNGIKUXG2DJFHLO7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F45Y7TXSU33MTKB6AGL2Q5V5ZOCNPKOG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSYFUGKFUSZ27M5TEZ3FKILWTWFJTFAZ/
- https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/
- https://security.netapp.com/advisory/ntap-20210416-0001/
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1043360
Get alerted when CVE-2021-22883 or the next vulnerability affects your stack