CVE-2021-22940: Debian Linux

High severity, CVSS 7.5. EPSS: 13.9% chance of exploitation in the next 30 days.

Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

Affected products

• Debian Debian Linux: version 10.0 only
• Netapp NextGen API: affected versions not specified
• Node.js Node.js: from 12.0.0, before 12.22.5 (fixed in 12.22.5); from 14.0.0, before 14.17.5 (fixed in 14.17.5); from 16.0.0, before 16.6.2 (fixed in 16.6.2)
• Oracle Graalvm: version 20.3.3 only; version 21.2.0 only
• Oracle Jd Edwards Enterpriseone Tools: up to and including 9.2.6.1
• Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)

Published 2021-08-16. Last modified 2026-06-17.