Node.js Vulnerability: Arbitrary Subject Alternative Name Acceptance
Summary
ALPINE-CVE-2021-44531: Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Affects nodejs versions < 12.22.10-r0. Fixed in 12.22.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications and APIs. The package in question, nodejs, is integral to many web applications, providing essential features such as asynchronous event-driven architecture. However, certain versions of Node.js are vulnerable to a security flaw that allows the acceptance of arbitrary Subject Alternative Name (SAN) types, which can lead to security breaches.
Vulnerability Detail
The vulnerability arises from Node.js versions prior to 12.22.9, 14.18.3, 16.13.2, and 17.3.1, which improperly accept URI SAN types. This flaw can enable attackers to bypass name-constrained intermediates in a Public Key Infrastructure (PKI), potentially leading to unauthorized access or man-in-the-middle attacks. The issue is exacerbated by the fact that when URI SANs are allowed, Node.js does not match the URI correctly, further compromising security.
How To Fix
Minimum fixed version
12.22.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, you can revert the behavior by using the command-line option --security-revert when starting your Node.js application. However, this is not a permanent solution and should be followed by an update as soon as possible.
Conclusion
In summary, the vulnerability in Node.js related to arbitrary Subject Alternative Name acceptance poses significant security risks. It is crucial for users to update their nodejs package to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and addressing such vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
Node.js versions prior to 12.22.9, 14.18.3, 16.13.2, and 17.3.1 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The risks include unauthorized access and the possibility of man-in-the-middle attacks due to improper handling of URI SAN types.
Yes, you can use the --security-revert command-line option to revert the behavior temporarily, but it is recommended to update to a patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
