Riskcovery

CVE-2021-44531

State
Published
Severity
Not scored
Published
Feb 24, 2022
Updated
Apr 30, 2025
Reserved
Dec 2, 2021

Read the record on cve.org

Description

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-295 Improper Certificate Validation (CWE-295)

Affected Products

ProductVersions
NodeNodeJS
  • 4.0 to before 4.*Affected
  • 5.0 to before 5.*Affected
  • 6.0 to before 6.*Affected
  • 7.0 to before 7.*Affected
  • 8.0 to before 8.*Affected
  • 9.0 to before 9.*Affected
  • 10.0 to before 10.*Affected
  • 11.0 to before 11.*Affected
  • 12.0 to before 12.22.9Affected
  • 13.0 to before 13.*Affected
  • 14.0 to before 14.18.3Affected
  • 15.0 to before 15.*Affected
  • 16.0 to before 16.13.2Affected
  • 17.0 to before 17.3.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.