CVE-2021-22931: Netapp Active Iq Unified Manager

Critical severity, CVSS 9.8. EPSS: 22% chance of exploitation in the next 30 days.

Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.

Affected products

• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp NextGen API: affected versions not specified
• Netapp Oncommand Insight: affected versions not specified
• Netapp Oncommand Workflow Automation: affected versions not specified
• Netapp Snapcenter: affected versions not specified
• Node.js Node.js: from 12.0.0, up to and including 12.12.0; from 12.13.0, before 12.22.5 (fixed in 12.22.5); from 14.0.0, up to and including 14.14.0; from 14.15.0, before 14.17.5 (fixed in 14.17.5); from 16.0.0, before 16.6.2 (fixed in 16.6.2)
• Oracle Graalvm: version 20.3.3 only; version 21.2.0 only
• Oracle MySQL Cluster: up to and including 8.0.26
• Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)

Published 2021-08-16. Last modified 2026-06-17.