CVE-2021-44532: High severity Nodejs Node.js vulnerability
It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.
Other sources
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.
Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection.
Reference: https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
— Red Hat
Node.js could allow a remote attacker to bypass security restrictions, caused by a string injection vulnerability when name constraints were used within a certificate chain. An attacker could exploit this vulnerability to bypass the name constraints.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-44532?
CVE-2021-44532 is a vulnerability in Node.js that allows a remote attacker to bypass security restrictions caused by a string injection vulnerability.
Which versions of Node.js are affected by CVE-2021-44532?
Node.js versions < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 are affected by CVE-2021-44532.
How does CVE-2021-44532 work?
CVE-2021-44532 occurs when Node.js converts SANs (Subject Alternative Names) to a string format, which was subject to an injection vulnerability when name constraints were used.
What is the severity of CVE-2021-44532?
CVE-2021-44532 has a severity rating of 7.4 (high).
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-44532?
CVE-2021-44532 is associated with CWE-295 and CWE-296.