CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2021-22883
High (7.5). EPSS 77% chance of exploitation in the next 30 days.
Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
Severity
- EPSS
- 77% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-11-01)
- CWEs
- CWE-772, CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- netapp:e-series_performance_analyzer
- nodejs:node.js
- oracle:graalvm
- oracle:jd_edwards_enterpriseone_tools
- oracle:mysql_cluster
- oracle:nosql_database
- oracle:peoplesoft_enterprise_peopletools
- siemens:sinec_infrastructure_network_services
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1043360
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E4FRS5ZVK4ZQ7XIJQNGIKUXG2DJFHLO7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F45Y7TXSU33MTKB6AGL2Q5V5ZOCNPKOG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSYFUGKFUSZ27M5TEZ3FKILWTWFJTFAZ/