Skip to content
OpenAdvisories
High ALSA-2021:3666 8 CVEs

Important: nodejs:14 security and bug fix update

Published Sep 27, 2021 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* nodejs:14/nodejs: Make FIPS options always available (BZ#1993924)

Fixed packages 3

ReleasePackageFixed in
AlmaLinux · 8 nodejs-nodemon 2.0.3-1.module_el8.4.0+2521+c668cc9f
AlmaLinux · 8 nodejs-packaging 23-3.module_el8.5.0+254+b4526b16
AlmaLinux · 8 nodejs-packaging 23-3.module_el8.4.0+2522+3bd42762

Vulnerabilities 8

  • High 8.2
    CVE-2021-32803

    Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

    The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a s…

    npm node-tar tar node-tar Debian Ubuntu npm
  • High 8.2
    CVE-2021-32804 Public exploit EPSS 15%

    Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

    The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning ab…

    npm node-tar tar node-tar Debian Ubuntu npm
  • Medium 5.3
    CVE-2021-23343

    Regular Expression Denial of Service (ReDoS)

    All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

    path-parse npm
  • Unscored —
    CVE-2021-22930 EPSS 36%

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to…

    Node.js node nodejs nodejs Debian Azure Linux Alpine
  • Unscored —
    CVE-2021-22931 EPSS 22%

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to mis…

    Node.js node nodejs nodejs Azure Linux Alpine
  • Unscored —
    CVE-2021-22939 EPSS 15%

    If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2021-22940 EPSS 14%

    Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to…

    Node.js node nodejs nodejs Debian Azure Linux
  • Unscored —
    CVE-2021-3672

    A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name S…

    nodejs nodejs-current ceph c-ares Debian Ubuntu Azure Linux Alpine

References

  • report
    https://bugzilla.redhat.com/1956818
  • report
    https://bugzilla.redhat.com/1988342
  • report
    https://bugzilla.redhat.com/1988394
  • report
    https://bugzilla.redhat.com/1990409
  • report
    https://bugzilla.redhat.com/1990415
  • report
    https://bugzilla.redhat.com/1993019
  • report
    https://bugzilla.redhat.com/1993029
  • report
    https://bugzilla.redhat.com/1993039
  • report
    https://bugzilla.redhat.com/1993924
  • advisory
    https://errata.almalinux.org/8/ALSA-2021-3666.html
  • report
    https://vulners.com/cve/CVE-2021-22930
  • report
    https://vulners.com/cve/CVE-2021-22931
  • report
    https://vulners.com/cve/CVE-2021-22939
  • report
    https://vulners.com/cve/CVE-2021-22940
  • report
    https://vulners.com/cve/CVE-2021-23343
  • report
    https://vulners.com/cve/CVE-2021-32803
  • report
    https://vulners.com/cve/CVE-2021-32804
  • report
    https://vulners.com/cve/CVE-2021-3672