CVE catalog

CVE-2021-22883

nodejs: CVE-2021-22883

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
77.39% · Oct 25, 2026

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannodejssid24.22.1+dfsg+~cs24.19.2-1fixed
Debiannodejsforky24.21.0+dfsg+~cs24.13.4-1fixed
Debiannodejstrixie20.19.2+dfsg-1+deb13u2fixed
Debiannodejstrixie-security20.19.2+dfsg-1+deb13u3fixed
Debiannodejsbookworm18.20.4+dfsg-1~deb12u2fixed
Debiannodejsbookworm-security18.20.4+dfsg-1~deb12u3fixed
BitnaminodeNot reported10.24.0fixed
BitnaminodeNot reported12.21.0fixed
BitnaminodeNot reported14.16.0fixed
BitnaminodeNot reported15.10.0fixed
Bitnaminode-minNot reported10.24.0fixed
Bitnaminode-minNot reported12.21.0fixed
Bitnaminode-minNot reported14.16.0fixed
Bitnaminode-minNot reported15.10.0fixed
Alpinenodejs3.1112.21.0-r0fixed
Alpinenodejs3.1212.21.0-r0fixed
Alpinenodejs3.1314.16.0-r0fixed
Alpinenodejs3.1414.16.0-r0fixed
Alpinenodejs3.1514.16.0-r0fixed
Alpinenodejs3.1614.16.0-r0fixed
Alpinenodejs3.1714.16.0-r0fixed
Alpinenodejs3.1814.16.0-r0fixed
Alpinenodejs3.1914.16.0-r0fixed
Alpinenodejs3.2014.16.0-r0fixed
Alpinenodejs3.2114.16.0-r0fixed
Alpinenodejs3.2214.16.0-r0fixed
Alpinenodejs3.2314.16.0-r0fixed
Alpinenodejs3.2414.16.0-r0fixed
Ubuntunodejspro6.11.4~dfsg-1ubuntu1vulnerable
Ubuntunodejspro6.11.4~dfsg-1ubuntu2vulnerable
Ubuntunodejspro6.12.0~dfsg-1ubuntu1vulnerable
Ubuntunodejspro6.12.0~dfsg-2ubuntu1vulnerable
Ubuntunodejspro6.12.0~dfsg-2ubuntu2vulnerable
Ubuntunodejspro8.10.0~dfsg-2vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.2vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.3vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm1vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm2vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm3vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm4vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm5vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm6vulnerable
Ubuntunodejs20.0410.15.2~dfsg-2ubuntu1vulnerable
Ubuntunodejs20.0410.17.0~dfsg-2ubuntu4vulnerable
Ubuntunodejs20.0410.17.0~dfsg-2ubuntu6vulnerable
Ubuntunodejs20.0410.19.0~dfsg-3ubuntu1vulnerable
Ubuntunodejs20.0410.19.0~dfsg-3ubuntu1.1vulnerable
Ubuntunodejs20.0410.19.0~dfsg-3ubuntu1.2fixed
Ubuntunodejspro6.11.4~dfsg-1ubuntu1vulnerable
Ubuntunodejspro6.11.4~dfsg-1ubuntu2vulnerable
Ubuntunodejspro6.12.0~dfsg-1ubuntu1vulnerable
Ubuntunodejspro6.12.0~dfsg-2ubuntu1vulnerable
Ubuntunodejspro6.12.0~dfsg-2ubuntu2vulnerable
Ubuntunodejspro8.10.0~dfsg-2vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.2vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.3vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm1vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm2vulnerable
Ubuntunodejspro8.10.0~dfsg-2ubuntu0.4+esm3fixed
Ubuntunodejs20.0410.15.2~dfsg-2ubuntu1vulnerable
Ubuntunodejs20.0410.17.0~dfsg-2ubuntu4vulnerable
Ubuntunodejs20.0410.17.0~dfsg-2ubuntu6vulnerable
Ubuntunodejs20.0410.19.0~dfsg-3ubuntu1vulnerable
Ubuntunodejs20.0410.19.0~dfsg-3ubuntu1.1vulnerable
Ubuntunodejs20.0410.19.0~dfsg-3ubuntu1.2fixed
Susenodejs12linux enterprise module for web and scripting 15 sp212.21.0-4.13.2fixed
Opensusenodejs14leap 15.214.16.0-lp152.8.1fixed
Susenodejs10linux enterprise module for web and scripting 15 sp210.24.0-1.33.2fixed
Susenodejs10linux enterprise high performance computing 15-espos10.24.0-1.33.2fixed
Susenodejs10linux enterprise high performance computing 15-ltss10.24.0-1.33.2fixed
Susenodejs10linux enterprise high performance computing 15 sp1-espos10.24.0-1.33.2fixed
Susenodejs10linux enterprise high performance computing 15 sp1-ltss10.24.0-1.33.2fixed
Susenodejs10linux enterprise server 15-ltss10.24.0-1.33.2fixed
Susenodejs10linux enterprise server 15 sp1-bcl10.24.0-1.33.2fixed
Susenodejs10linux enterprise server 15 sp1-ltss10.24.0-1.33.2fixed
Susenodejs10linux enterprise server for sap applications 1510.24.0-1.33.2fixed
Susenodejs10linux enterprise server for sap applications 15 sp110.24.0-1.33.2fixed
Susenodejs10manager proxy 4.010.24.0-1.33.2fixed
Susenodejs10manager retail branch server 4.010.24.0-1.33.2fixed
Susenodejs10manager server 4.010.24.0-1.33.2fixed
Susenodejs10enterprise storage 610.24.0-1.33.2fixed
Opensusenodejs12leap 15.212.21.0-lp152.3.12.1fixed
Susenodejs14linux enterprise module for web and scripting 15 sp214.16.0-5.9.1fixed
Susenodejs10linux enterprise module for web and scripting 1210.24.0-1.36.2fixed
Susenodejs12linux enterprise module for web and scripting 1212.21.0-1.29.2fixed
Susenodejs14linux enterprise module for web and scripting 1214.16.0-6.9.2fixed
Opensusenodejs10leap 15.210.24.0-lp152.2.12.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannodejssourcesid12.21.0~dfsg-1not yet assignedNot reportedNot reported
Debiannodejssourceforky12.21.0~dfsg-1not yet assignedNot reportedNot reported
Debiannodejssourcetrixie12.21.0~dfsg-1not yet assignedNot reportedNot reported
Debiannodejssourcebookworm12.21.0~dfsg-1not yet assignedNot reportedNot reported
BitnaminodeBitnamiNot reported10.24.0Not reportedBIT-NODE-2021-22883Not reported
BitnaminodeBitnamiNot reported12.21.0Not reportedBIT-NODE-2021-22883Not reported
BitnaminodeBitnamiNot reported14.16.0Not reportedBIT-NODE-2021-22883Not reported
BitnaminodeBitnamiNot reported15.10.0Not reportedBIT-NODE-2021-22883Not reported
Bitnaminode-minBitnamiNot reported10.24.0Not reportedBIT-NODE-MIN-2021-22883Not reported
Bitnaminode-minBitnamiNot reported12.21.0Not reportedBIT-NODE-MIN-2021-22883Not reported
Bitnaminode-minBitnamiNot reported14.16.0Not reportedBIT-NODE-MIN-2021-22883Not reported
Bitnaminode-minBitnamiNot reported15.10.0Not reportedBIT-NODE-MIN-2021-22883Not reported
Alpinenodejsapk3.1112.21.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.1212.21.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.1314.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.1414.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.1514.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.1614.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.1714.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.1814.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.1914.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.2014.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.2114.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.2214.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.2314.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Alpinenodejsapk3.2414.16.0-r0Not reportedALPINE-CVE-2021-22883Not reported
Ubuntunodejsdeb20.0410.19.0~dfsg-3ubuntu1.2Not reportedUBUNTU-CVE-2021-22883Not reported
Ubuntunodejsdebpro8.10.0~dfsg-2ubuntu0.4+esm3Not reportedUSN-6418-1Not reported
Ubuntunodejsdeb20.0410.19.0~dfsg-3ubuntu1.2Not reportedUSN-6418-1Not reported
Susenodejs12rpmlinux enterprise module for web and scripting 15 sp212.21.0-4.13.2Not reportedSUSE-SU-2021:0651-1Not reported
Opensusenodejs14rpmleap 15.214.16.0-lp152.8.1Not reportedOPENSUSE-SU-2021:0356-1Not reported
Susenodejs10rpmlinux enterprise module for web and scripting 15 sp210.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15-espos10.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15-ltss10.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15 sp1-espos10.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15 sp1-ltss10.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmlinux enterprise server 15-ltss10.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmlinux enterprise server 15 sp1-bcl10.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmlinux enterprise server 15 sp1-ltss10.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmlinux enterprise server for sap applications 1510.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmlinux enterprise server for sap applications 15 sp110.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmmanager proxy 4.010.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmmanager retail branch server 4.010.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmmanager server 4.010.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Susenodejs10rpmenterprise storage 610.24.0-1.33.2Not reportedSUSE-SU-2021:0674-1Not reported
Opensusenodejs12rpmleap 15.212.21.0-lp152.3.12.1Not reportedOPENSUSE-SU-2021:0357-1Not reported
Susenodejs14rpmlinux enterprise module for web and scripting 15 sp214.16.0-5.9.1Not reportedSUSE-SU-2021:0648-1Not reported
Susenodejs10rpmlinux enterprise module for web and scripting 1210.24.0-1.36.2Not reportedSUSE-SU-2021:0673-1Not reported
Susenodejs12rpmlinux enterprise module for web and scripting 1212.21.0-1.29.2Not reportedSUSE-SU-2021:0649-1Not reported
Susenodejs14rpmlinux enterprise module for web and scripting 1214.16.0-6.9.2Not reportedSUSE-SU-2021:0650-1Not reported
Opensusenodejs10rpmleap 15.210.24.0-lp152.2.12.1Not reportedOPENSUSE-SU-2021:0372-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libnode108]Unknown

    Source package: [nodejs]

    Details (4)
    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [libnode-dev]Unknown

    Source package: [nodejs]

    Details (4)
    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [nodejs]Unknown
    Details (4)
    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

  • [nodejs-doc]Unknown

    Source package: [nodejs]

    Details (4)
    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

    • 18.20.4+dfsg-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12

[Debian 13 (Trixie)]

  • [libnode115]Unknown

    Source package: [nodejs]

    Details (5)
    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

  • [libnode-dev]Unknown

    Source package: [nodejs]

    Details (5)
    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

  • [nodejs]Unknown
    Details (5)
    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

  • [nodejs-doc]Unknown

    Source package: [nodejs]

    Details (5)
    • 20.19.2+dfsg-1+deb13u2 · all · trixie

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u2 · all · trixie-security · Historical version

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

    • 20.19.2+dfsg-1+deb13u3 · all · trixie-security

      Fixed · Fixed: 12.21.0~dfsg-1

      dsa · nodejs · debian · 13

Observed:

References