This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2021-22918 →
DEBIAN-CVE-2021-22918
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointe...
Original description
The description as published by the source.
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
libuv1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-2"}]}]
Debian:13
libuv1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-2"}]}]
Debian:14
libuv1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-2"}]}]
References
- advisory security-tracker.debian.org