Denial of Service Vulnerability in Node.js - CVE-2021-22883
Summary
ALPINE-CVE-2021-22883: Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. Affects nodejs versions < 12.21.0-r0. Fixed in 12.21.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications due to its non-blocking I/O model and event-driven architecture. However, certain versions of Node.js are vulnerable to a denial of service attack, which can lead to significant operational issues.
Vulnerability Detail
The vulnerability identified as CVE-2021-22883 affects Node.js versions prior to 10.24.0, 12.21.0, 14.16.0, and 15.10.0. It arises from the handling of connection attempts with an 'unknownProtocol', which can lead to a leak of file descriptors. This leak can exhaust the file descriptor limit on the system, preventing the server from accepting new connections and potentially causing excessive memory usage, leading to system instability and crashes.
How To Fix
Minimum fixed version
12.21.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing rate limiting on connection attempts to mitigate the risk of denial of service attacks. This can be achieved by configuring your server settings to limit the number of connections from a single IP address.
Conclusion
CVE-2021-22883 is a significant vulnerability in Node.js that can lead to denial of service attacks. It is crucial for users to update their Node.js installations to the latest patched versions to mitigate the risks associated with this vulnerability. Additionally, implementing workarounds such as rate limiting can provide temporary relief until a full update can be performed.
See every vulnerability recorded for nodejs →
FAQ
CVE-2021-22883 is a vulnerability in Node.js that allows for denial of service attacks due to improper handling of connection attempts with an 'unknownProtocol'.
Node.js versions prior to 10.24.0, 12.21.0, 14.16.0, and 15.10.0 are vulnerable.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to a leak of file descriptors, causing the server to become unresponsive and potentially exhausting system memory.
The CVSS score for CVE-2021-22883 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
