CVE-2021-22918: Node.js

Medium severity, CVSS 5.3. EPSS: 23.1% chance of exploitation in the next 30 days.

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().

Affected products

• Node.js Node.js: from 12.0.0, before 12.22.2 (fixed in 12.22.2); from 14.0.0, before 14.17.2 (fixed in 14.17.2); from 16.0.0, before 16.4.1 (fixed in 16.4.1)
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)

Published 2021-07-12. Last modified 2026-06-17.