CVE-2021-22883
HighNode.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established.
Published Apr 1, 2022 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2021-22883, BIT-node-2021-22883, BIT-node-min-2021-22883, DEBIAN-CVE-2021-22883, DSA-4863-1, SUSE-SU-2021:0648-1, SUSE-SU-2021:0649-1, SUSE-SU-2021:0650-1, SUSE-SU-2021:0651-1, SUSE-SU-2021:0673-1, SUSE-SU-2021:0674-1, TR-21-0198, TR-21-0212, UBUNTU-CVE-2021-22883, USN-6418-1
Key Facts
Patch immediately- CVE-2021-22883 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting E-Series Performance Analyzer (Netapp), Node.js (Nodejs), Graalvm (Oracle) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 77% probability of exploitation in the next 30 days.
- Fixed versions are available, including Node 10.24.0, Node 12.21.0, Node 14.16.0.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
77%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2021-22883 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
Affected Products
198 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| E-Series Performance AnalyzerNetapp | See advisory | n/a |
| Node.jsNodejs | See advisory | 15.10.0 |
| GraalvmOracle | 19.3.5, 20.3.1.2, 21.0.0.2 | n/a |
| Jd Edwards Enterpriseone ToolsOracle | See advisory | 9.2.6.0 |
| Mysql ClusterOracle | See advisory | 8.0.25 |
Patched Releases
Node
10.24.0, 12.21.0, 14.16.0, 15.10.0, 11.*, 13.*, 4.*, 5.*, 6.*, 7.*, 8.*, 9.*
node-min
10.24.0, 12.21.0, 14.16.0, 15.10.0
nodejs
1:10.24.0-1.module_el8.4.0+2224+b07ac28e, 1:10.24.0-1.module+el8.3.0+101+f84c7154, 1:10.24.0-1.module+el8.3.0+9671+154373c8, 1:12.21.0-1.module+el8.3.0+9672+c7b0544d, 1:12.21.0-1.module+el8.3.0+99+3663d81c, 1:14.16.0-2.module+el8.3.0+100+234774f7, 1:14.16.0-2.module+el8.3.0+9674+b4c6acab, 10.19.0~dfsg-3ubuntu1.2, 10.24.0-1.ph2, 10.24.0~dfsg-1~deb10u1, 12.21.0-r0, 12.21.0~dfsg-1, 14.16.0-1.ph4, 14.16.0-r0, 15.10.0-1, 8.10.0~dfsg-2ubuntu0.4+esm3
Node.js
10.24.0, 15.10.0
nodejs-current
15.10.0-r0
nodejs-devel
1:10.24.0-1.module+el8.3.0+9671+154373c8, 1:12.21.0-1.module+el8.3.0+9672+c7b0544d, 1:14.16.0-2.module+el8.3.0+9674+b4c6acab, 14.16.0-1.ph4
nodejs-docs
1:10.24.0-1.module+el8.3.0+9671+154373c8, 1:12.21.0-1.module+el8.3.0+9672+c7b0544d, 1:14.16.0-2.module+el8.3.0+9674+b4c6acab
nodejs-full-i18n
1:10.24.0-1.module+el8.3.0+9671+154373c8, 1:12.21.0-1.module+el8.3.0+9672+c7b0544d, 1:14.16.0-2.module+el8.3.0+9674+b4c6acab
nodejs-lts-fermium
14.16.0-1
nodejs-nodemon
1.18.3-1.module_el8.3.0+2023+d2377ea3, 1.18.3-1.module+el8.1.0+5392+4d6b561f, 1.18.3-1.module+el8.3.0+101+f84c7154, 2.0.3-1.module_el8.4.0+2521+c668cc9f, 2.0.3-1.module+el8.3.0+7818+6cd30d85, 2.0.3-1.module+el8.3.0+9643+8c99e187, 2.0.3-1.module+el8.6.0+982+9fdca2d4
nodejs-packaging
17-3.module_el8.4.0+2224+b07ac28e, 17-3.module+el8.1.0+5392+4d6b561f, 17-3.module+el8.1.0+5393+aaf413e3, 17-3.module+el8.3.0+101+f84c7154, 23-3.module_el8.5.0+254+b4526b16, 23-3.module+el8.3.0+7818+6cd30d85, 23-3.module+el8.7.0+1071+4bdda2a8
nodejs:10
8030020210225164533.229f0a1c
nodejs:12
8010020210302113522.c27ad7f8
nodejs:14
8030020210301172147.229f0a1c
nodejs10
10.24.0-1.33.2, 10.24.0-1.36.2, 10.24.0-1.ph1, 10.24.0-lp152.2.12.1
nodejs10-devel
10.24.0-1.33.2, 10.24.0-1.36.2, 10.24.0-lp152.2.12.1
nodejs10-docs
10.24.0-1.33.2, 10.24.0-1.36.2, 10.24.0-lp152.2.12.1
nodejs12
12.21.0-1.29.2, 12.21.0-4.13.2, 12.21.0-lp152.3.12.1
nodejs12-devel
12.21.0-1.29.2, 12.21.0-4.13.2, 12.21.0-lp152.3.12.1
nodejs12-docs
12.21.0-1.29.2, 12.21.0-4.13.2, 12.21.0-lp152.3.12.1
nodejs14
14.16.0-5.9.1, 14.16.0-6.9.2, 14.16.0-lp152.8.1, 14.17.5-1.2
nodejs14-devel
14.16.0-5.9.1, 14.16.0-6.9.2, 14.16.0-lp152.8.1, 14.17.5-1.2
nodejs14-docs
14.16.0-5.9.1, 14.16.0-6.9.2, 14.16.0-lp152.8.1, 14.17.5-1.2
npm
1:6.14.11-1.10.24.0.1.module+el8.3.0+9671+154373c8, 1:6.14.11-1.12.21.0.1.module+el8.3.0+9672+c7b0544d, 1:6.14.11-1.14.16.0.2.module+el8.3.0+9674+b4c6acab
npm10
10.24.0-1.33.2, 10.24.0-1.36.2, 10.24.0-lp152.2.12.1
Timeline
Publicly disclosed
Apr 1, 2022
Last updated
Oct 16, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
- CWE-772 Missing Release of Resource after Effective Lifetime
References
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14779
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14792
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14796
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14797
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1968
FAQ
Common Questions.
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established.
Affected: E-Series Performance Analyzer (Netapp); Node.js (Nodejs); Graalvm (Oracle) versions 19.3.5, 20.3.1.2, 21.0.0.2, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Node 10.24.0, Node 12.21.0, Node 14.16.0.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2021-22883 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo