CVE-2021-22939: Input Validation
A flaw was found in Node.js. If the Node.js HTTPS API is used incorrectly and "undefined" is passed for the "rejectUnauthorized" parameter, no error is returned, and the connections to servers with an expired certificate are accepted. The highest threat from this vulnerability is to integrity.
Other sources
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
Node.js could allow a remote attacker to bypass security restrictions. If the https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, an attacker could exploit this vulnerability to connect to servers using an expired certificate.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-22939?
CVE-2021-22939 is a vulnerability in Node.js where if the HTTPS API is used incorrectly and "undefined" is passed for the "rejectUnauthorized" parameter, connections to servers with an expired certificate are accepted.
What is the severity of CVE-2021-22939?
The severity of CVE-2021-22939 is low with a CVSS score of 3.7.
How does CVE-2021-22939 affect Node.js?
CVE-2021-22939 allows connections to servers with an expired certificate to be accepted if the HTTPS API is used incorrectly.
Which versions of Node.js are affected by CVE-2021-22939?
Node.js versions 12.22.5, 14.17.5, and 16.6.2 are affected by CVE-2021-22939.
How do I fix CVE-2021-22939?
To fix CVE-2021-22939, upgrade Node.js to version 12.22.5, 14.17.5, or 16.6.2.