Node.js 14 and 8 others: Improper Following of a Certificate's Chain of Trust (CWE-296)
CVE-2021-44532 is fixed in 16 products on 2 platforms, first by Node.js 12 12.22.9, released January 10, 2022. 5 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 12 | 12.22.9 | Node.js 12 12.22.9 | Jan 10, 2022 |
| Node.js 14 | 14.18.3 | Node.js 14 14.18.3 | Jan 10, 2022 |
| Node.js 16 | 16.13.2 | Node.js 16 16.13.2 | Jan 10, 2022 |
| Node.js 17 | 17.3.1 | Node.js 17 17.3.1 | Jan 10, 2022 |
| Linux | |||
| nodejs · Debian 12.15 (bookworm) | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44532 | Feb 24, 2022 |
| nodejs · Debian 13.5 (trixie) | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44532 | Feb 24, 2022 |
| nodejs · Debian 14 | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44532 | Feb 24, 2022 |
| nodejs · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs · rocky 8 | 1:16.18.1-3.module+el8.7.0+1108+49363b0d | RLSA-2022:9073 | Dec 15, 2022 |
| nodejs-debuginfo · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-debugsource · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-devel · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-devel · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-devel · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-devel · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-docs · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-docs · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-docs · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-docs · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-full-i18n · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-full-i18n · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-full-i18n · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-full-i18n · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-libs · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-libs-debuginfo · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-nodemon · RHEL 8 | 0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-nodemon · almalinux 8 | 2.0.20-2.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-nodemon · ol 8 | 0:2.0.20-2.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-nodemon · rocky 8 | 0:2.0.20-2.module+el8.7.0+1108+49363b0d | RLSA-2022:9073 | Dec 15, 2022 |
| nodejs-packaging · RHEL 8 | 0:25-1.module+el8.5.0+10992+fac5fe06 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-packaging · almalinux 8 | 25-1.module_el8.5.0+2605+45d748af | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-packaging · ol 8 | 0:25-1.module+el8.5.0+20388+4b61e68d | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-packaging · rocky 8 | 0:25-1.module+el8.6.0+1046+80feca58 | RLSA-2022:9073 | Dec 15, 2022 |
| npm · RHEL 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| npm · almalinux 8 | 1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| npm · amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| npm · ol 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| v8-devel · amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| No fix yet | |||
| Node.js 10 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 4 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 6 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 7 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 8 (Windows apps) | No fix yet | no-fix | n/a |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.