CVE-2021-22918

2021-07-1200:00:00

CWE-125

hackerone

www.cve.org

node.js

vulnerability

out-of-bounds read

uv__idna_toascii()

information disclosure

crashes

uv_getaddrinfo

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

46.5%

JSON

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/nodejs/node",
    "versions": [
      {
        "version": "Fixed in 16.4.1, 14.17.2, and 12.22.2",
        "status": "affected"
      }
    ]
  }
]