Riskcovery

CVE-2021-22918

State
Published
Severity
Not scored
Published
Jul 12, 2021
Updated
Apr 30, 2025
Reserved
Jan 6, 2021

Read the record on cve.org

Description

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Scores

The record has no CVSS score.

Weaknesses

  • CWE-125 Out-of-bounds Read (CWE-125)

Affected Products

ProductVersions
NodeNodeJS
  • 4.0 to before 4.*Affected
  • 5.0 to before 5.*Affected
  • 6.0 to before 6.*Affected
  • 7.0 to before 7.*Affected
  • 8.0 to before 8.*Affected
  • 9.0 to before 9.*Affected
  • 10.0 to before 10.*Affected
  • 11.0 to before 11.*Affected
  • 12.0 to before 12.22.2Affected
  • 13.0 to before 13.*Affected
  • 14.0 to before 14.17.2Affected
  • 15.0 to before 15.*Affected
  • 16.0 to before 16.4.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.