Node.js patches HTTP/2 denial of service, DNS rebinding and OpenSSL vulnerabilities

Node.js released security updates for its 10.x, 12.x, 14.x and 15.x lines to address HTTP/2 resource exhaustion, a DNS rebinding protection bypass and an OpenSSL vulnerability. CVE-2021-22883 allows repeated connections using an unknown protocol to leak file descriptors, potentially preventing servers from accepting connections or opening files, or exhausting system memory. CVE-2021-22884 permits bypassing DNS rebinding protections through the inspector’s localhost6 allowlist entry when that name is absent from the local hosts file and an attacker controls or spoofs DNS responses. Fixed releases include Node.js 10.24.0, 12.21.0 and 14.16.0; Fedora subsequently distributed Node.js 12.21.0-2.fc32 for Fedora 32 and 14.16.0-1.fc34 for Fedora 34.

The Node.js advisory also linked to OpenSSL’s security update covering three flaws: CVE-2021-23841, a moderate-severity certificate-processing NULL-pointer dereference; CVE-2021-23840, a low-severity cipher API integer overflow that can cause application errors or crashes; and CVE-2021-23839, a low-severity rollback-protection error affecting narrowly configured legacy OpenSSL 1.0.2 servers. These OpenSSL issues have distinct applicability and should not all be assumed to affect Node.js. At release, OpenSSL recommended 1.1.1j for affected 1.1.1 installations, while 1.0.2y was restricted to premium-support customers. Organizations retaining these historical Node.js, Fedora or OpenSSL versions should migrate to currently supported releases rather than treating the 2021 fixes as sufficient protection today.