Node.js 14 and 8 others: Improper Certificate Validation (CWE-295)
CVE-2021-44533 is fixed in 16 products on 2 platforms, first by Node.js 12 12.22.9, released January 10, 2022. 5 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 12 | 12.22.9 | Node.js 12 12.22.9 | Jan 10, 2022 |
| Node.js 14 | 14.18.3 | Node.js 14 14.18.3 | Jan 10, 2022 |
| Node.js 16 | 16.13.2 | Node.js 16 16.13.2 | Jan 10, 2022 |
| Node.js 17 | 17.3.1 | Node.js 17 17.3.1 | Jan 10, 2022 |
| Linux | |||
| nodejs · Debian 12.15 (bookworm) | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44533 | Feb 24, 2022 |
| nodejs · Debian 13.5 (trixie) | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44533 | Feb 24, 2022 |
| nodejs · Debian 14 | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44533 | Feb 24, 2022 |
| nodejs · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs · rocky 8 | 1:16.18.1-3.module+el8.7.0+1108+49363b0d | RLSA-2022:9073 | Dec 15, 2022 |
| nodejs-debuginfo · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-debugsource · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-devel · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-devel · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-devel · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-devel · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-docs · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-docs · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-docs · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-docs · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-full-i18n · RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-full-i18n · almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-full-i18n · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-full-i18n · ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-libs · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-libs-debuginfo · amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| nodejs-nodemon · RHEL 8 | 0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-nodemon · almalinux 8 | 2.0.20-2.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-nodemon · ol 8 | 0:2.0.20-2.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-nodemon · rocky 8 | 0:2.0.20-2.module+el8.7.0+1108+49363b0d | RLSA-2022:9073 | Dec 15, 2022 |
| nodejs-packaging · RHEL 8 | 0:25-1.module+el8.5.0+10992+fac5fe06 | RHSA-2022:9073 | Dec 15, 2022 |
| nodejs-packaging · almalinux 8 | 25-1.module_el8.5.0+2605+45d748af | ALSA-2022:9073 | Dec 15, 2022 |
| nodejs-packaging · ol 8 | 0:25-1.module+el8.5.0+20388+4b61e68d | ELSA-2022-9073-1 | Dec 16, 2022 |
| nodejs-packaging · rocky 8 | 0:25-1.module+el8.6.0+1046+80feca58 | RLSA-2022:9073 | Dec 15, 2022 |
| npm · RHEL 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 | RHSA-2022:9073 | Dec 15, 2022 |
| npm · almalinux 8 | 1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 | Dec 15, 2022 |
| npm · amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| npm · ol 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+20893+df13f383 | ELSA-2022-9073-1 | Dec 16, 2022 |
| v8-devel · amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.2 | ALAS2023-2023-084 | Feb 17, 2023 |
| No fix yet | |||
| Node.js 10 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 4 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 6 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 7 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 8 (Windows apps) | No fix yet | no-fix | n/a |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.