CVE-2021-22883

HIGH7.5EPSS 89.4%

nodejs - security update

發布日:2021/3/3修改日:2025/12/3

也稱為:ALPINE-CVE-2021-22883

描述

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

受影響套件(5)

Alpine/nodejsfrom 0, < 12.21.0-r0
Bitnami/node>= 10.0.0, < 10.24.0, >= 12.0.0, < 12.21.0, >= 14.0.0, < 14.16.0, >= 15.0.0, < 15.10.0
Bitnami/node-min>= 10.0.0, < 10.24.0, >= 12.0.0, < 12.21.0, >= 14.0.0, < 14.16.0, >= 15.0.0, < 15.10.0
Debian/nodejsfrom 0, < 12.21.0~dfsg-1
Debian/nodejsfrom 0, < 10.24.0~dfsg-1~deb10u1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

描述

受影響套件(5)

CVSS 分數

參考連結(13)