CVE-2021-22930: debian debian_linux Use After Free

Modified

AliasesALPINE-CVE-2021-22930MGASA-2021-0394SUSE-SU-2021:2790-1+5 more

Published 07-10-2021Last modified 30-04-2025

Vulnerability summary

CVE-2021-22930 is a critical (CVSS 9.8) Use After Free vulnerability in debian debian_linux. EPSS estimates a 36.45% chance of exploitation in the next 30 days, higher than 98.4% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 36% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

36.45%

0%100%

High · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

07-10-2021
PublishedVulnerability first disclosed.
30-04-2025
Last modifiedVulnerability information updated.

Description

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.19.8v2.07.5

EPSS trend

Probability

36.45%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 36.45% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse14 products

nodejs8&distro=SUSE Enterprise Storage 6< 8.17.0-3.50.1
nodejs8&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 8.17.0-3.50.1
nodejs8&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 8.17.0-3.50.1
nodejs8&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 8.17.0-3.50.1
nodejs8&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 8.17.0-3.50.1

Show all 14

Alpine2 products

nodejs< 12.22.4-r0 | < 14.17.4-r0
nodejs-current< 16.6.0-r0

Debian2 products

nodejs< 12.22.4~dfsg-1
debian_linuxEOL10.0

Nodejs2 products

node≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.22.4 | ≥ 13.0, < 13.* | ≥ 14.0, < 14.17.4 | ≥ 15.0, < 15.* | ≥ 16.0, < 16.6.0
node.js≥ 12.0.0, < 12.22.4 | ≥ 14.0.0, < 14.17.4 | ≥ 16.0.0, < 16.6.0

Opensuse2 products