vulnerability

Rocky Linux: CVE-2021-22931: nodejs-14 (Multiple Advisories)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

Published

Aug 16, 2021

Added

May 5, 2022

Modified

Mar 31, 2026

Description

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

Solutions

rocky-upgrade-nodejsrocky-upgrade-nodejs-debuginforocky-upgrade-nodejs-debugsourcerocky-upgrade-nodejs-develrocky-upgrade-nodejs-full-i18nrocky-upgrade-npm

References

CVE-2021-22931
https://attackerkb.com/topics/CVE-2021-22931
CWE-170
CWE-20
EUVD-EUVD-2021-10060
https://errata.rockylinux.org/RLSA-2021:3623
https://errata.rockylinux.org/RLSA-2021:3666
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10060

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report