Non notée
CVE-2021-22883 Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many…
Description
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Node 15.0 | 15.0 → < 15.10.0 | 15.10.0 |
| Node 14.0 | 14.0 → < 14.16.0 | 14.16.0 |
| Node 13.0 | 13.0 → dernières | Pas de correctif indiqué |
| Node 12.0 | 12.0 → < 12.21.0 | 12.21.0 |
| Node 11.0 | 11.0 → dernières | Pas de correctif indiqué |
| Node 10.0 | 10.0 → < 10.24.0 | 10.24.0 |
| Node 9.0 | 9.0 → dernières | Pas de correctif indiqué |
| Node 8.0 | 8.0 → dernières | Pas de correctif indiqué |
| Node 7.0 | 7.0 → dernières | Pas de correctif indiqué |
Références
- nodejs.org nodejs.org
- hackerone.com hackerone.com
- FEDORA-2021-a760169c3c lists.fedoraproject.org
- FEDORA-2021-f6bd75e9d4 lists.fedoraproject.org
- FEDORA-2021-6aaba80ba2 lists.fedoraproject.org
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- cert-portal.siemens.com cert-portal.siemens.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Node
Les 129 CVE de Node →
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a…
7.4
Élevée
CVE-2026-106070
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after…
3.7
Faible
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Moyenne
CVE-2026-106069
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP…
7.4
Élevée