Node.js Vulnerability: Improper Handling of Wildcards in X.509 Certificates
Summary
UBUNTU-CVE-2016-7099: The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows m... Affects nodejs versions < 0.10.25~dfsg2-2ubuntu1.2+esm1. Fixed in 0.10.25~dfsg2-2ubuntu1.2+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular JavaScript runtime built on Chrome's V8 JavaScript engine, enabling developers to build scalable network applications. It is widely used for server-side programming and offers a rich ecosystem of libraries and frameworks. However, certain versions of Node.js are vulnerable to a security issue that affects the tls.checkServerIdentity function, which can lead to man-in-the-middle attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2016-7099, affects Node.js versions 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0. It arises from the improper handling of wildcards in the name fields of X.509 certificates. This flaw allows attackers to spoof servers by presenting a crafted certificate, potentially leading to unauthorized access and data interception.
How To Fix
Minimum fixed version
0.10.25~dfsg2-2ubuntu1.2+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional validation checks on the server side to ensure that the certificates presented are legitimate and not spoofed. However, this is not a substitute for updating to a secure version of Node.js.
Conclusion
CVE-2016-7099 presents a significant security risk for applications using affected versions of Node.js. It is crucial for developers and system administrators to update their Node.js installations to the patched versions to protect against potential attacks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for nodejs →
FAQ
CVE-2016-7099 is a vulnerability in Node.js that allows man-in-the-middle attackers to spoof servers via a crafted certificate due to improper handling of wildcards in X.509 certificates.
The affected versions include Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2016-7099 is 5.9, indicating a medium severity level.
If immediate updates are not possible, implement additional server-side validation checks to mitigate the risk of man-in-the-middle attacks.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
