High
Security advisory
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-22940
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:29 UTC · Revision 1
Source evidence
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
osv:CVE-2021-22940
Complete source record
{
"id": "d5d71c8e0d6f0b6d682601e5a20ee4b23fd6a310e2a2dfa8a8ecd46352a88674",
"url": "https://osv.dev/vulnerability/CVE-2021-22940",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-22940",
"summary": "Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.",
"evidence": "osv:CVE-2021-22940",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-22940",
"aliases": [
"BIT-node-2021-22940",
"BIT-node-min-2021-22940",
"CVE-2021-22940"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/graalvm/graalvm-ce-builds",
"type": "GIT",
"events": [
{
"introduced": "55ff3f2503007a859219b5e7f68b0f6ca95225f0"
},
{
"last_affected": "771d7a8d2b73cf72a2622ca6305dcc9e9306f296"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "20.3.3"
},
{
"last_affected": "20.3.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*",
"range": [
{
"introduced": "21.2.0"
},
{
"last_affected": "21.2.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"20.3.3",
"21.2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22940.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/nodejs/node",
"type": "GIT",
"events": [
{
"introduced": "2f45ad8060e13d5ac912335096d21526f2f9602b"
},
{
"fixed": "151261efb8b85696620f80ecc1f50d9c1f886a1b"
},
{
"introduced": "73aa21658dfa6a22c06451d080152b32b1f98dbe"
},
{
"fixed": "db159ab870b1aa7f55e4e450c81764f22bf0ef80"
},
{
"introduced": "7162e686b18d22b4385fa5c04274fb04dbd810c7"
},
{
"fixed": "bfe80913e88139da1aa283475cdbc060ea98ae6f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
"range": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.22.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
"range": [
{
"introduced": "14.0.0"
},
{
"fixed": "14.17.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"range": [
{
"introduced": "16.0.0"
},
{
"fixed": "16.6.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v16.6.1",
"v16.6.0",
"v14.17.4",
"v12.22.4",
"v16.5.0",
"v16.4.2",
"v14.17.3",
"v12.22.3",
"v14.17.2",
"v16.4.1",
"v12.22.2",
"v16.4.0",
"v14.17.1",
"v16.3.0",
"v16.2.0",
"v14.17.0",
"v16.1.0",
"v16.0.0",
"v14.16.1",
"v12.22.1",
"v12.22.0",
"v14.16.0",
"v12.21.0",
"v12.20.2",
"v14.15.5",
"v14.15.4",
"v12.20.1",
"v14.15.3",
"v14.15.2",
"v12.20.0",
"v12.19.1",
"v14.15.1",
"v14.15.0",
"v14.14.0",
"v14.13.1",
"v12.19.0",
"v14.13.0",
"v14.12.0",
"v12.18.4",
"v14.11.0",
"v14.10.1",
"v14.10.0",
"v14.9.0",
"v14.8.0",
"v14.7.0",
"v12.18.3",
"v14.6.0",
"v14.5.0",
"v12.18.2",
"v12.18.1",
"v12.18.0",
"v14.4.0",
"v12.17.0",
"v14.3.0",
"v14.2.0",
"v14.1.0",
"v12.16.3",
"v14.0.0",
"v12.16.2",
"v12.16.1",
"v12.16.0",
"v12.15.0",
"v12.14.1",
"v12.14.0",
"v12.13.1",
"v12.13.0",
"v12.12.0",
"v12.11.1",
"v12.11.0",
"v12.10.0",
"v12.9.1",
"v12.9.0",
"v12.8.1",
"v12.8.0",
"v12.7.0",
"v12.6.0",
"v12.5.0",
"v12.4.0",
"v12.3.1",
"v12.3.0",
"v12.2.0",
"v12.1.0",
"v12.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-22940.json"
}
}
],
"modified": "2026-10-24T10:30:18.905426775Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html",
"https://security.gentoo.org/glsa/202401-02",
"https://security.netapp.com/advisory/ntap-20210923-0001/",
"https://hackerone.com/reports/1238162",
"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://www.oracle.com/security-alerts/cpujul2022.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:jd_edwards_enterpriseone_tools",
"extracted_events": [
{
"range": [
{
"last_affected": "9.2.6.1"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*"
],
"vendor_product": "siemens:sinec_infrastructure_network_services",
"extracted_events": [
{
"range": [
{
"fixed": "1.0.1.1"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:peoplesoft_enterprise_peopletools",
"extracted_events": [
{
"range": [
{
"introduced": "8.57"
},
{
"last_affected": "8.57"
},
{
"introduced": "8.58"
},
{
"last_affected": "8.58"
},
{
"introduced": "8.59"
},
{
"last_affected": "8.59"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-22940",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 429885,
"published_at": "2021-08-16T19:15:13.987+00:00"
}