# CVE-2021-44532: Node.js 14 and 8 others: Improper Following of a Certificate's Chain of Trust (CWE-296)

CVE-2021-44532 is fixed in 16 products on 2 platforms, first by Node.js 12 12.22.9, released January 10, 2022. 5 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2021-44532
- Priority: High
- CVSS: 9.8 (Moderate)
- EPSS: 0.1036
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 24, 2022
- Weakness: CWE-296: Improper Following of a Certificate's Chain of Trust (CWE-296)
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2021-44532

## Description

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 12 | 12.22.9 | [Node.js 12 12.22.9](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.12-12.22.9.md) | Jan 10, 2022 |
| Windows apps | Node.js 14 | 14.18.3 | [Node.js 14 14.18.3](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.14-14.18.3.md) | Jan 10, 2022 |
| Windows apps | Node.js 16 | 16.13.2 | [Node.js 16 16.13.2](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.16-16.13.2.md) | Jan 10, 2022 |
| Windows apps | Node.js 17 | 17.3.1 | [Node.js 17 17.3.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.17-17.3.1.md) | Jan 10, 2022 |
| Linux | nodejs Debian 12.15 (bookworm) | 12.22.9~dfsg-1 | [DEBIAN-CVE-2021-44532](https://patchblox.com/security/data/fix/linux/debian-cve-2021-44532.md) | Feb 24, 2022 |
| Linux | nodejs Debian 13.5 (trixie) | 12.22.9~dfsg-1 | [DEBIAN-CVE-2021-44532](https://patchblox.com/security/data/fix/linux/debian-cve-2021-44532.md) | Feb 24, 2022 |
| Linux | nodejs Debian 14 | 12.22.9~dfsg-1 | [DEBIAN-CVE-2021-44532](https://patchblox.com/security/data/fix/linux/debian-cve-2021-44532.md) | Feb 24, 2022 |
| Linux | nodejs RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs rocky 8 | 1:16.18.1-3.module+el8.7.0+1108+49363b0d | [RLSA-2022:9073](https://patchblox.com/security/data/fix/linux/rlsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-debugsource amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-devel RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-devel almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-devel amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-devel ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-docs RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-docs almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-docs amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-docs ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-full-i18n RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-full-i18n almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-full-i18n amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-full-i18n ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-libs amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-libs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-nodemon RHEL 8 | 0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-nodemon almalinux 8 | 2.0.20-2.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-nodemon ol 8 | 0:2.0.20-2.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-nodemon rocky 8 | 0:2.0.20-2.module+el8.7.0+1108+49363b0d | [RLSA-2022:9073](https://patchblox.com/security/data/fix/linux/rlsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-packaging RHEL 8 | 0:25-1.module+el8.5.0+10992+fac5fe06 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-packaging almalinux 8 | 25-1.module_el8.5.0+2605+45d748af | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-packaging ol 8 | 0:25-1.module+el8.5.0+20388+4b61e68d | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-packaging rocky 8 | 0:25-1.module+el8.6.0+1046+80feca58 | [RLSA-2022:9073](https://patchblox.com/security/data/fix/linux/rlsa-2022-9073.md) | Dec 15, 2022 |
| Linux | npm RHEL 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | npm almalinux 8 | 1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | npm amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | npm ol 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | v8-devel amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |

## No fix yet

| Platform | Product | Status |
|---|---|---|
| Windows apps | Node.js 10 | no-fix |
| Windows apps | Node.js 4 | no-fix |
| Windows apps | Node.js 6 | no-fix |
| Windows apps | Node.js 7 | no-fix |
| Windows apps | Node.js 8 | no-fix |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.