Out-of-Bounds Read Vulnerability in Node.js
Summary
CVE-2021-22918: Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. Affects nodejs across 2 version ranges.
>= 2f45ad8060e13d5ac912335096d21526f2f9602b, < 4eb2de9a776873d0475db611a8e7cba716afdf6b
< 12.22.2-r0
Fixed in 12.22.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications and is widely used for server-side programming. This vulnerability affects Node.js versions before 16.4.1, 14.17.2, and 12.22.2. The vulnerability arises when the function uv__idna_toascii() is used to convert strings to ASCII, leading to an out-of-bounds read. This can result in information disclosure or crashes. The vulnerable function can be triggered via uv_getaddrinfo().
Vulnerability Detail
The vulnerability (CVE-2021-22918) in Node.js arises due to an out-of-bounds read in the uv__idna_toascii() function. When converting strings to ASCII, the pointer p is read and incremented without checking if it goes beyond the end of the buffer (pe). This can lead to information disclosure or crashes. Attackers could potentially exploit this vulnerability to obtain sensitive information or disrupt the application. The vulnerability has a CVSS score of 5.3.
How To Fix
Minimum fixed version
12.22.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if updating Node.js is not immediately feasible, developers can consider implementing input validation and sanitization to prevent malicious input from triggering the vulnerable function. By carefully validating and sanitizing user input, the risk of exploitation can be reduced.
Conclusion
The out-of-bounds read vulnerability in Node.js can lead to information disclosure or crashes in affected applications. It is crucial to update Node.js to the fixed versions (16.4.1, 14.17.2, or 12.22.2) to mitigate the risk. If immediate updating is not possible, implementing input validation and sanitization can help reduce the likelihood of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
This vulnerability can lead to information disclosure or crashes in Node.js applications. Attackers could potentially exploit this vulnerability to obtain sensitive information or disrupt the application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
No, only versions before 16.4.1, 14.17.2, and 12.22.2 are affected by this vulnerability. It is recommended to update to the fixed versions to mitigate the risk.
Yes, Node.js versions 16.4.1, 14.17.2, and 12.22.2 include the necessary patches to address this vulnerability. Updating to these versions will ensure that the vulnerability is fixed.
If updating Node.js is not immediately feasible, you can implement input validation and sanitization to mitigate the risk. By carefully validating and sanitizing user input, the likelihood of exploitation can be reduced.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
