Skip to content
OpenAdvisories
High RLSA-2021:3623 8 CVEs

Important: nodejs:12 security and bug fix update

Published Sep 21, 2021 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930)

* nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22940)

* c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

* nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

* nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite (CVE-2021-32803)

* nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite (CVE-2021-32804)

* nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

* nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* nodejs:12/nodejs: Make FIPS options always available (BZ#1993927)

Fixed packages 5

ReleasePackageFixed in
Rocky Linux · 8 nodejs 1:12.22.5-1.module+el8.4.0+647+e905fa21
Rocky Linux · 8 nodejs-nodemon 0:2.0.3-1.module+el8.6.0+982+9fdca2d4
Rocky Linux · 8 nodejs-nodemon 0:2.0.3-1.module+el8.3.0+100+234774f7
Rocky Linux · 8 nodejs-nodemon 0:2.0.3-1.module+el8.4.0+638+5344c6f7
Rocky Linux · 8 nodejs-packaging 0:17-3.module+el8.3.0+101+f84c7154

Vulnerabilities 8

  • High 8.2
    CVE-2021-32803

    Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning

    The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a s…

    npm node-tar tar node-tar Debian Ubuntu npm
  • High 8.2
    CVE-2021-32804 Public exploit EPSS 15%

    Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

    The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning ab…

    npm node-tar tar node-tar Debian Ubuntu npm
  • Medium 5.3
    CVE-2021-23343

    Regular Expression Denial of Service (ReDoS)

    All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

    path-parse npm
  • Unscored —
    CVE-2021-22930 EPSS 36%

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to…

    Node.js node nodejs nodejs Debian Azure Linux Alpine
  • Unscored —
    CVE-2021-22931 EPSS 22%

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to mis…

    Node.js node nodejs nodejs Azure Linux Alpine
  • Unscored —
    CVE-2021-22939 EPSS 15%

    If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no …

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2021-22940 EPSS 14%

    Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to…

    Node.js node nodejs nodejs Debian Azure Linux
  • Unscored —
    CVE-2021-3672

    A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name S…

    nodejs nodejs-current ceph c-ares Debian Ubuntu Azure Linux Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1956818
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1988342
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1988394
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1990409
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1990415
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1993019
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1993029
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1993039
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1993927