CVE-2021-22940: debian debian_linux Use After Free

Modified

AliasesUBUNTU-CVE-2021-22940DEBIAN-CVE-2021-22940

Published 16-08-2021Last modified 30-04-2025

Vulnerability summary

CVE-2021-22940 is a high (CVSS 7.5) Use After Free vulnerability in debian debian_linux. EPSS estimates a 13.86% chance of exploitation in the next 30 days, higher than 96.5% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 14% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

13.86%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 19 · Related 11

DLA-3137-1 MGASA-2021-0463 OPENSUSE-SU-2021:1214-1 OPENSUSE-SU-2021:1313-1 OPENSUSE-SU-2021:2875-1 OPENSUSE-SU-2021:3211-1+13 more

Timeline

16-08-2021
PublishedVulnerability first disclosed.
30-04-2025
Last modifiedVulnerability information updated.

Description

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

13.86%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 13.86% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Oracle3 products

graalvmEOL20.3.3 | 21.2.0
jd_edwards_enterpriseone_tools≤ 9.2.6.1
peoplesoft_enterprise_peopletools8.57 | 8.58 | 8.59

Debian2 products

nodejs< 12.22.5~dfsg-1
debian_linuxEOL10.0

Nodejs2 products

node≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.22.5 | ≥ 13.0, < 13.* | ≥ 14.0, < 14.17.5 | ≥ 15.0, < 15.* | ≥ 16.0, < 16.6.2
node.js≥ 12.0.0, < 12.22.5 | ≥ 14.0.0, < 14.17.5 | ≥ 16.0.0, < 16.6.2

Netapp1 product