Vulnerability Database

313,825

Total vulnerabilities in the database

CVE-2021-22921

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

  • Published: Jul 12, 2021
  • Updated: Nov 16, 2025
  • CVE: CVE-2021-22921
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.8
  • AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: Low
  • Score: 4.4
  • AV:L/AC:M/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
nodejs / node.js 12.0.0 12.22.2
nodejs / node.js 14.0.0 14.17.2
nodejs / node.js 16.0.0 16.4.1
siemens / sinec_infrastructure_network_services - 1.0.1.1