CVE-2021-44532

Summary

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the –security-revert command-line option.

Affected Software

VendorProductVersion RangeStatus
NodeJSNode4.0 < 4.*affected
NodeJSNode5.0 < 5.*affected
NodeJSNode6.0 < 6.*affected
NodeJSNode7.0 < 7.*affected
NodeJSNode8.0 < 8.*affected
NodeJSNode9.0 < 9.*affected
NodeJSNode10.0 < 10.*affected
NodeJSNode11.0 < 11.*affected
NodeJSNode12.0 < 12.22.9affected
NodeJSNode13.0 < 13.*affected
NodeJSNode14.0 < 14.18.3affected
NodeJSNode15.0 < 15.*affected
NodeJSNode16.0 < 16.13.2affected
NodeJSNode17.0 < 17.3.1affected

Weaknesses

  • CWE-296: Improper Following of a Certificate's Chain of Trust (CWE-296)

ADP Enrichment

CVE Program Container

Additional References

References