Node.js 14 and 8 others: Improper Certificate Validation (CWE-295)
CVE-2021-44531 is fixed in 16 products on 2 platforms, first by Node.js 12 12.22.9, released January 10, 2022. 5 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 12 | 12.22.9 | Node.js 12 12.22.9 | Jan 10, 2022 |
| Node.js 14 | 14.18.3 | Node.js 14 14.18.3 | Jan 10, 2022 |
| Node.js 16 | 16.13.2 | Node.js 16 16.13.2 | Jan 10, 2022 |
| Node.js 17 | 17.3.1 | Node.js 17 17.3.1 | Jan 10, 2022 |
| Linux | |||
| nodejs · Debian 12.15 (bookworm) | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44531 | Feb 24, 2022 |
| nodejs · Debian 13.5 (trixie) | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44531 | Feb 24, 2022 |
| nodejs · Debian 14 | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44531 | Feb 24, 2022 |
| nodejs · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs · rocky 8 | 1:16.18.1-3.module+el8.7.0+1108+49363b0d | RLSA-2022:9073 | Dec 15, 2022 |
| nodejs-debuginfo · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-debugsource · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-devel · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-devel · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-devel · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-devel · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-docs · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-docs · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-docs · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-docs · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-full-i18n · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-full-i18n · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-full-i18n · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-full-i18n · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-libs · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-libs-debuginfo · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-nodemon · RHEL 8 | 0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-nodemon · almalinux 8 | 2.0.20-2.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-nodemon · ol 8 | 0:2.0.20-2.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-nodemon · rocky 8 | 0:2.0.20-2.module+el8.7.0+1108+49363b0d | RLSA-2022:9073 | Dec 15, 2022 |
| nodejs-packaging · RHEL 8 | 0:25-1.module+el8.5.0+10992+fac5fe06 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-packaging · almalinux 8 | 25-1.module_el8.5.0+2605+45d748af | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-packaging · ol 8 | 0:25-1.module+el8.5.0+20388+4b61e68d | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-packaging · rocky 8 | 0:25-1.module+el8.6.0+1046+80feca58 | RLSA-2022:9073 | Dec 15, 2022 |
| npm · RHEL 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| npm · almalinux 8 | 1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| npm · amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| npm · ol 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| v8-devel · amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| No fix yet | |||
| Node.js 10 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 4 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 6 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 7 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 8 (Windows apps) | No fix yet | no-fix | n/a |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.