Node.js Vulnerability: Multi-Value Relative Distinguished Names Handling Issue
Summary
ALPINE-CVE-2021-44533: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Affects nodejs versions < 12.22.10-r0. Fixed in 12.22.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source JavaScript runtime built on Chrome's V8 JavaScript engine. It allows developers to build scalable network applications. The package is widely used for server-side development and is known for its event-driven, non-blocking I/O model. However, certain versions of Node.js have a vulnerability related to the handling of multi-value Relative Distinguished Names (RDNs) in certificate subjects, which can lead to security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2021-44533, affects Node.js versions prior to 12.22.9, 14.18.3, 16.13.2, and 17.3.1. It arises from the incorrect handling of multi-value RDNs, allowing attackers to craft certificate subjects that could bypass certificate subject verification. This could potentially lead to unauthorized access or impersonation attacks, as third-party code relying on Node.js's ambiguous presentation of certificate subjects may be exploited.
How To Fix
Minimum fixed version
12.22.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, consider implementing additional validation checks on certificate subjects in your application code to mitigate the risk of exploitation until the package can be updated.
Conclusion
The vulnerability CVE-2021-44533 in Node.js poses a significant risk due to improper handling of multi-value Relative Distinguished Names in certificate subjects. It is crucial for developers to update their Node.js installations to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nodejs →
FAQ
CVE-2021-44533 is a vulnerability in Node.js that affects how multi-value Relative Distinguished Names are handled in certificate subjects.
Node.js versions prior to 12.22.9, 14.18.3, 16.13.2, and 17.3.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
If immediate updates are not possible, implement additional validation checks on certificate subjects in your application to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
