CVE-2021-22918: nodejs node Out-of-bounds Read
Vulnerability summary
CVE-2021-22918 is a medium (CVSS 5.3) Out-of-bounds Read vulnerability in nodejs node. EPSS estimates a 23.13% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 20 · Related 14Timeline
- 12-07-2021PublishedVulnerability first disclosed.
- 30-04-2025Last modifiedVulnerability information updated.
Description
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().
CVSS metrics
6 scores · 5 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
23.13%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 23.13% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat4 products
- libuv< 1:1.41.1-1.el8_4
- libuv-debuginfo< 1:1.41.1-1.el8_4
- libuv-debugsource< 1:1.41.1-1.el8_4
- libuv-devel< 1:1.41.1-1.el8_4
Nodejs2 products
Alpine1 product
- nodejs< 12.22.2-r0 | < 14.17.3-r0
Debian1 product
- libuv1< 1.24.1-1+deb10u1 | < 1.40.0-2
Mageia1 product
- libuv< 1.40.0-1.1.mga8
Opensuse1 product
- libuv&distro=openSUSE Tumbleweed< 1.42.0-1.2
Siemens1 product
Ubuntu1 product
- libuv1< 1.34.2-1ubuntu1.3
8 vendors · 12 products
References
20 links- security.netapp.com/advisory/ntap-20210805-0003/Third Party Advisory
- security.gentoo.org/glsa/202401-23Vendor Advisory
