Injection Vulnerability in Node.js Package - CVE-2021-44532
Summary
UBUNTU-CVE-2021-44532: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. Affects nodejs versions 12.22.5~dfsg-5ubuntu1 – 12.22.9~dfsg-1ubuntu3.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine, enabling developers to build scalable network applications. The package 'nodejs' is widely used for server-side development and is known for its non-blocking, event-driven architecture. However, certain versions of Node.js are vulnerable to an injection issue that affects the validation of peer certificates, particularly when using Subject Alternative Names (SANs) in certificates.
Vulnerability Detail
Node.js versions prior to 12.22.9, 14.18.3, 16.13.2, and 17.3.1 have a vulnerability that allows an attacker to bypass name constraints in a certificate chain due to improper handling of SANs. This can lead to potential man-in-the-middle attacks, where an attacker could impersonate a legitimate server, compromising the security of data in transit. The vulnerability arises from the conversion of SANs to a string format, which is then used for hostname validation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot update the package immediately, you can revert the behavior to the previous version using the command-line option --security-revert when starting your Node.js application. This will disable the problematic SAN handling temporarily.
Conclusion
The CVE-2021-44532 vulnerability in Node.js poses a significant risk by allowing attackers to bypass important security checks in certificate validation. It is crucial for users of affected versions to update their Node.js installations to the latest patched versions to mitigate this risk. For those unable to update immediately, a temporary workaround is available.
See every vulnerability recorded for nodejs →
FAQ
CVE-2021-44532 is a vulnerability in Node.js that allows attackers to bypass name constraints in certificates, potentially leading to man-in-the-middle attacks.
Node.js versions below 12.22.9, 14.18.3, 16.13.2, and 17.3.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.3, indicating a medium severity level.
If an immediate update is not possible, you can use the --security-revert command-line option to temporarily disable the problematic SAN handling.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
