# CVE-2021-44533: Node.js 14 and 8 others: Improper Certificate Validation (CWE-295)

CVE-2021-44533 is fixed in 16 products on 2 platforms, first by Node.js 12 12.22.9, released January 10, 2022. 5 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2021-44533
- Priority: High
- CVSS: 9.8 (Moderate)
- EPSS: 0.0936
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 24, 2022
- Weakness: CWE-295: Improper Certificate Validation (CWE-295)
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2021-44533

## Description

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 12 | 12.22.9 | [Node.js 12 12.22.9](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.12-12.22.9.md) | Jan 10, 2022 |
| Windows apps | Node.js 14 | 14.18.3 | [Node.js 14 14.18.3](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.14-14.18.3.md) | Jan 10, 2022 |
| Windows apps | Node.js 16 | 16.13.2 | [Node.js 16 16.13.2](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.16-16.13.2.md) | Jan 10, 2022 |
| Windows apps | Node.js 17 | 17.3.1 | [Node.js 17 17.3.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.17-17.3.1.md) | Jan 10, 2022 |
| Linux | nodejs Debian 12.15 (bookworm) | 12.22.9~dfsg-1 | [DEBIAN-CVE-2021-44533](https://patchblox.com/security/data/fix/linux/debian-cve-2021-44533.md) | Feb 24, 2022 |
| Linux | nodejs Debian 13.5 (trixie) | 12.22.9~dfsg-1 | [DEBIAN-CVE-2021-44533](https://patchblox.com/security/data/fix/linux/debian-cve-2021-44533.md) | Feb 24, 2022 |
| Linux | nodejs Debian 14 | 12.22.9~dfsg-1 | [DEBIAN-CVE-2021-44533](https://patchblox.com/security/data/fix/linux/debian-cve-2021-44533.md) | Feb 24, 2022 |
| Linux | nodejs RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs rocky 8 | 1:16.18.1-3.module+el8.7.0+1108+49363b0d | [RLSA-2022:9073](https://patchblox.com/security/data/fix/linux/rlsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-debugsource amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-devel RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-devel almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-devel amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-devel ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-docs RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-docs almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-docs amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-docs ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-full-i18n RHEL 8 | 1:16.18.1-3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-full-i18n almalinux 8 | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-full-i18n amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-full-i18n ol 8 | 1:16.18.1-3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-libs amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-libs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | nodejs-nodemon RHEL 8 | 0:2.0.20-2.module+el8.7.0+17412+bb0e4a6b | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-nodemon almalinux 8 | 2.0.20-2.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-nodemon ol 8 | 0:2.0.20-2.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-nodemon rocky 8 | 0:2.0.20-2.module+el8.7.0+1108+49363b0d | [RLSA-2022:9073](https://patchblox.com/security/data/fix/linux/rlsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-packaging RHEL 8 | 0:25-1.module+el8.5.0+10992+fac5fe06 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-packaging almalinux 8 | 25-1.module_el8.5.0+2605+45d748af | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | nodejs-packaging ol 8 | 0:25-1.module+el8.5.0+20388+4b61e68d | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | nodejs-packaging rocky 8 | 0:25-1.module+el8.6.0+1046+80feca58 | [RLSA-2022:9073](https://patchblox.com/security/data/fix/linux/rlsa-2022-9073.md) | Dec 15, 2022 |
| Linux | npm RHEL 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74 | [RHSA-2022:9073](https://patchblox.com/security/data/fix/linux/rhsa-2022-9073.md) | Dec 15, 2022 |
| Linux | npm almalinux 8 | 1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db | [ALSA-2022:9073](https://patchblox.com/security/data/fix/linux/alsa-2022-9073.md) | Dec 15, 2022 |
| Linux | npm amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |
| Linux | npm ol 8 | 1:8.19.2-1.16.18.1.3.module+el8.7.0+20893+df13f383 | [ELSA-2022-9073-1](https://patchblox.com/security/data/fix/linux/elsa-2022-9073-1.md) | Dec 16, 2022 |
| Linux | v8-devel amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.2 | [ALAS2023-2023-084](https://patchblox.com/security/data/fix/linux/alas2023-2023-084.md) | Feb 17, 2023 |

## No fix yet

| Platform | Product | Status |
|---|---|---|
| Windows apps | Node.js 10 | no-fix |
| Windows apps | Node.js 4 | no-fix |
| Windows apps | Node.js 6 | no-fix |
| Windows apps | Node.js 7 | no-fix |
| Windows apps | Node.js 8 | no-fix |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.