CVE-2021-44532 vulnerability in nodejs and Other Products
Published on February 24, 2022
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
Weakness Type
Improper Following of a Certificate's Chain of Trust
The software does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.
Products Associated with CVE-2021-44532
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-44532 are published in these products:
Affected Versions
NodeJS Node:- Version 4.0 and below 4.* is affected.
- Version 5.0 and below 5.* is affected.
- Version 6.0 and below 6.* is affected.
- Version 7.0 and below 7.* is affected.
- Version 8.0 and below 8.* is affected.
- Version 9.0 and below 9.* is affected.
- Version 10.0 and below 10.* is affected.
- Version 11.0 and below 11.* is affected.
- Version 12.0 and below 12.22.9 is affected.
- Version 13.0 and below 13.* is affected.
- Version 14.0 and below 14.18.3 is affected.
- Version 15.0 and below 15.* is affected.
- Version 16.0 and below 16.13.2 is affected.
- Version 17.0 and below 17.3.1 is affected.
Exploit Probability
EPSS
0.13%
Percentile
32.82%
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.