CVE-2021-44531: High severity Nodejs Node.js vulnerability
A flaw was found in node.js where it accepted a certificate's Subject Alternative Names (SAN) entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host.
Other sources
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.
Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname.
Reference: https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
— Red Hat
Node.js could allow a remote attacker to bypass security restrictions, caused by the improper handling of URI Subject Alternative Name (SAN) types. An attacker could exploit this vulnerability to bypass name-constrained intermediates.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-44531?
CVE-2021-44531 is a vulnerability in Node.js that could allow a remote attacker to bypass security restrictions.
How does CVE-2021-44531 impact Node.js?
CVE-2021-44531 impacts Node.js versions < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 by accepting arbitrary Subject Alternative Name (SAN) types, potentially bypassing name-constrained intermediates.
What is the severity of CVE-2021-44531?
The severity of CVE-2021-44531 is high, with a severity value of 7.4.
How do I fix CVE-2021-44531 in Node.js?
To fix CVE-2021-44531 in Node.js, you should update to version 12.22.9 or later, 14.18.3 or later, 16.13.2 or later, or 17.3.1 or later.
Where can I find more information about CVE-2021-44531?
You can find more information about CVE-2021-44531 at the following references: [link1], [link2], [link3].