What’s Vulnerable › Vulnerabilities
CVE-2021-22939
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 14.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-08-16 · updated 2026-06-17
- Weakness: CWE-295
Description
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
Affected products
- Debian Linux: 10.0
- NetApp Nextgen Api: all versions
- Node.js: from 12.0.0 before 12.22.5; from 14.0.0 before 14.17.5; from 16.0.0 before 16.6.2 — fixed in 12.22.5, 14.17.5, 16.6.2
- Oracle Corporation GraalVM Enterprise Edition: 20.3.3, 21.2.0
- Oracle Corporation JD Edwards EnterpriseOne Tools: through 9.2.6.1
- Oracle Corporation MySQL Cluster: through 8.0.26
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.57, 8.58, 8.59
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
How to fix
Upgrade to a fixed version: Node.js 12.22.5, 14.17.5, 16.6.2; Siemens Sinec Infrastructure Network Services 1.0.1.1. Check the vendor advisory for mitigations.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1278254
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210917-0003/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1278254
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
Get alerted when CVE-2021-22939 or the next vulnerability affects your stack