CVE-2021-22883

Name	CVE-2021-22883
Description	Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DSA-4863-1
NVD severity	high

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nodejs (PTS)	stretch	4.8.2~dfsg-1	vulnerable
	buster, buster (security)	10.24.0~dfsg-1~deb10u1	fixed
	bullseye (security), bullseye	12.22.5~dfsg-2~11u1	fixed
	bookworm	12.22.5~dfsg-5	fixed
	sid	12.22.7~dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nodejs	source	buster	10.24.0~dfsg-1~deb10u1		DSA-4863-1
nodejs	source	(unstable)	12.21.0~dfsg-1

Notes

[stretch] - nodejs <ignored> (Nodejs in stretch not covered by security support)
https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/