Maple Labs

CVE search · CVE-2021-44532

CVE-2021-44532

medium 5.3

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
support@hackerone.com
Weakness
CWE-296, CWE-295

Severity

VersionScoreVectorSource
CVSS 3.1 medium 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N nvd@nist.govPrimary
CVSS 2.0 medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

References