UpHeron
All vulnerabilities

Servers and applications

CVE-2024-21892

On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to…

Severity
High 7.8
Published
20 Feb 2024
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
18.19.1, 20.11.1, 21.6.2
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 18.0.0 before 18.19.1
  • From 20.0.0 before 20.11.1
  • From 21.0.0 before 21.6.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-21892
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-21892