Critical Memory Corruption Vulnerability in Node.js - CVE-2021-22930

nodejs Updated 02 Oct 2025

Summary

07/10/2021

Disclosed on

N/A

Severity

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

ALPINE-CVE-2021-22930: Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Affects nodejs versions < 12.22.4-r0. Fixed in 12.22.4-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The vulnerability identified as CVE-2021-22930 affects multiple versions of Node.js, specifically versions prior to 16.6.0, 14.17.4, and 12.22.4. This vulnerability exposes applications to potential memory corruption, which can lead to severe security risks.

Vulnerability Detail

CVE-2021-22930 is a use-after-free vulnerability that occurs when memory is freed but still accessed, allowing an attacker to exploit this flaw. This can lead to unexpected behavior in the application, including the potential for arbitrary code execution, data corruption, or denial of service. The vulnerability is particularly dangerous due to its high CVSS score of 9.8, indicating critical severity.

How To Fix

Minimum fixed version

12.22.4-r0

This is the first release that contains the fix.

sudo apk add --upgrade nodejs

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

If immediate upgrading is not feasible, consider implementing strict input validation and sanitization to mitigate the risk of exploitation. Additionally, running applications in a restricted environment can help limit the impact of potential attacks.

Conclusion

CVE-2021-22930 is a critical vulnerability in Node.js that poses significant risks to applications using affected versions. It is crucial to update to the latest patched versions to protect against potential exploitation. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.

See every vulnerability recorded for nodejs →