PT-2021-6094 · Node.Js+7 · Node.Js+7
Published
2020-01-24
·
Updated
2026-05-18
·
CVE-2021-44531
CVSS v3.1
7.4
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Node.js versions prior to 12.22.9
Node.js versions prior to 14.18.3
Node.js versions prior to 16.13.2
Node.js versions prior to 17.3.1
Description
The issue is related to the implementation of Subject Alternative Names in the Node.js platform, specifically with errors in the certificate authentication procedure. This can allow a remote attacker to conduct spoofing attacks by bypassing name-constrained intermediates. The problem arises from accepting arbitrary Subject Alternative Name types, including URI SAN types, which are not typically defined for use by Public Key Infrastructures. When protocols allow URI SANs, Node.js did not correctly match the URI, leading to potential security bypasses.
Recommendations
For Node.js versions prior to 12.22.9, update to version 12.22.9 or later to disable the URI SAN type when checking a certificate against a hostname.
For Node.js versions prior to 14.18.3, update to version 14.18.3 or later to disable the URI SAN type when checking a certificate against a hostname.
For Node.js versions prior to 16.13.2, update to version 16.13.2 or later to disable the URI SAN type when checking a certificate against a hostname.
For Node.js versions prior to 17.3.1, update to version 17.3.1 or later to disable the URI SAN type when checking a certificate against a hostname.
As a temporary workaround, consider using the --security-revert command-line option to revert the behavior of disabling the URI SAN type, but be aware that this may reintroduce the security risk.
Fix
Prototype Pollution
Improper Certificate Validation
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Node.Js
Red Hat
Red Os
Rocky Linux
Suse