CVE-2021-22931
Quick assessment
Affected
NodeJS Node
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
node core是一个基于 Egg.js 的 Node.js 服务端基础框架。 Node Core存在输入验证错误漏洞，目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
Possible ATT&CK Techniques 3 AI
T1041 · Exfiltration Over C2 Channel T1189 · Drive-by Compromise T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-22931
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不恰当的空终结符
Source: CVE Program / CVE List V5
Vulnerability Title
node core 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
node core是一个基于 Egg.js 的 Node.js 服务端基础框架。 Node Core存在输入验证错误漏洞，目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2021-22931
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-22931
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-22931 (7)
-
https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
-
https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
-
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf x_refsource_CONFIRM
-
https://security.netapp.com/advisory/ntap-20211022-0003/ x_refsource_CONFIRM
-
https://security.netapp.com/advisory/ntap-20210923-0001/ x_refsource_CONFIRM
-
https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC
-
https://security.gentoo.org/glsa/202401-02 vendor-advisory
Security Blog Posts for CVE-2021-22931 (1)
-
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/ x_refsource_MISC
Other References for CVE-2021-22931 (1)
-
https://hackerone.com/reports/1178337 x_refsource_MISC
Same Patch Batch · NodeJS · 2021-08-16 · 3 CVEs total
| CVE-2021-22939 | node core 信任管理问题漏洞 | |
| CVE-2021-22940 | node core 资源管理错误漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-170
-
CVE-2026-78506
Microsoft Office Word Information Disclosure Vulnerability -
CVE-2026-70587
Windows Remote Desktop Protocol Information Disclosure Vulne -
CVE-2026-12386
Buffer Overflow in TUBITAK BILGEM's Pardus Pen -
CVE-2026-5067
Out-of-bounds read/write in HTTP WebSocket upgrade via non-n -
CVE-2026-8721
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl trunca
V. Comments for CVE-2021-22931
No comments yet