Injection Vulnerability in Node.js Affecting Multiple Alpine Versions
Summary
ALPINE-CVE-2021-44532: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. Affects nodejs versions < 12.22.10-r0. Fixed in 12.22.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine, widely used for building scalable network applications. It allows developers to use JavaScript on the server side, enabling full-stack development with a single language. The vulnerability in question affects various versions of Node.js packaged in Alpine Linux distributions, which are lightweight and commonly used in containerized environments.
Vulnerability Detail
Node.js versions prior to 12.22.9, 14.18.3, 16.13.2, and 17.3.1 contain an injection vulnerability related to the conversion of Subject Alternative Names (SANs) to string format. This flaw can lead to a bypass of name constraints within a certificate chain, potentially allowing malicious actors to exploit the vulnerability for man-in-the-middle attacks. The issue arises when name constraints are used, as the improper handling of SANs can lead to incorrect hostname validation during secure connections.
How To Fix
Minimum fixed version
12.22.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround is to run Node.js with the --security-revert command-line option. This option reverts the behavior to the previous version, which may mitigate the injection issue, but it is not a permanent solution.
Conclusion
The injection vulnerability in Node.js affects multiple Alpine versions, posing a risk of bypassing name constraints in certificate validation. Users are advised to update to the patched versions to mitigate this risk. Temporary workarounds are available, but they do not replace the need for a proper update.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
Node.js versions < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 are affected by this vulnerability.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can also check your application using the Vulert playground without any signup.
The vulnerability can allow attackers to bypass name constraints in certificates, leading to potential man-in-the-middle attacks and unauthorized access to sensitive data.
Yes, the permanent fix is to update Node.js to the specified patched versions as outlined in the 'how to fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
