CVE-2021-22883: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 77.4% chance of exploitation in the next 30 days.

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.

Affected products

• Fedoraproject Fedora: version 32 only; version 33 only; version 34 only
• Netapp E-Series Performance Analyzer: affected versions not specified
• Node.js Node.js: from 10.0.0, before 10.24.0 (fixed in 10.24.0); from 12.0.0, before 12.21.0 (fixed in 12.21.0); from 14.0.0, before 14.16.0 (fixed in 14.16.0); from 15.0.0, before 15.10.0 (fixed in 15.10.0)
• Oracle Graalvm: version 19.3.5 only; version 20.3.1.2 only; version 21.0.0.2 only
• Oracle Jd Edwards Enterpriseone Tools: before 9.2.6.0 (fixed in 9.2.6.0)
• Oracle MySQL Cluster: up to and including 8.0.25
• Oracle Nosql Database: before 20.3 (fixed in 20.3)
• Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)

Published 2021-03-03. Last modified 2026-06-17.