Skip to content
fr Sign in
Not rated

CVE-2021-22883 Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many…

Description

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

Affected products and versions

Product Affected versions Fixed in
Node 15.0 15.0 → < 15.10.0 15.10.0
Node 14.0 14.0 → < 14.16.0 14.16.0
Node 13.0 13.0 → latest No fix stated
Node 12.0 12.0 → < 12.21.0 12.21.0
Node 11.0 11.0 → latest No fix stated
Node 10.0 10.0 → < 10.24.0 10.24.0
Node 9.0 9.0 → latest No fix stated
Node 8.0 8.0 → latest No fix stated
Node 7.0 7.0 → latest No fix stated
Show the 3 other branches
Product Affected versions Fixed in
Node 6.0 6.0 → latest No fix stated
Node 5.0 5.0 → latest No fix stated
Node 4.0 4.0 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Node

The 129 CVEs of Node →
CVE-2026-105482 A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*()… 7.4 High CVE-2026-106070 A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after… 3.7 Low CVE-2026-106074 A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,… 4.8 Medium CVE-2026-105483 A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a… 7.4 High
Track this CVE