CVE-2021-22883CWE-400

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol'…

published March 3, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.6th percentile for exploit probability.

CVSS
—
EPSS
77%
Percentile
99.6
In the wild
Unconfirmed
What it is

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.77385 · 99.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2021-03-03T17:38Z
EPSS history
Timeline
  • 03 MAR 17:38Z
    Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol'…
    cvelistv5