CVE-2021-44532

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-296 CWE-295

Affected software

Vendor	Product	Versions
NodeJS	Node	>= 4.0, < 4.; >= 5.0, < 5.; >= 6.0, < 6.; >= 7.0, < 7.; >= 8.0, < 8.; >= 9.0, < 9.; >= 10.0, < 10.; >= 11.0, < 11.; >= 12.0, < 12.22.9; >= 13.0, < 13.; >= 14.0, < 14.18.3; >= 15.0, < 15.; >= 16.0, < 16.13.2; >= 17.0, < 17.3.1

References

https://hackerone.com/reports/1429694Mitigation, Third Party Advisory
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/Exploit, Release Notes, Vendor Advisory
https://security.netapp.com/advisory/ntap-20220325-0007/Third Party Advisory
https://www.debian.org/security/2022/dsa-5170Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
https://hackerone.com/reports/1429694Mitigation, Third Party Advisory
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/Exploit, Release Notes, Vendor Advisory
https://security.netapp.com/advisory/ntap-20220325-0007/Third Party Advisory
https://www.debian.org/security/2022/dsa-5170Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory

Timeline

Published: Feb 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-445335.3Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could cra CVE-2021-445346.5Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclos CVE-2021-445377.8ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execut CVE-2021-445389.8The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryp CVE-2021-44545.5In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate The co CVE-2021-445407.5A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec before bailing.CVE-2021-445417.5A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the CVE-2021-445427.5A memory leak vulnerability was found in Privoxy when handling errors.CVE-2021-445436.1An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the template name when Privoxy is configured CVE-2021-445446.1DIAEnergie Version 1.7.5 and prior is vulnerable to multiple cross-site scripting vulnerabilities when arbitrary code is injected into the p CVE-2021-445456.5Improper input validation for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow an unauthenticated user to potential CVE-2021-445479.1A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading t