CVE-2021-39171: Unlimited transforms allowed for signed nodes

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-27 · updated 2026-06-17
Weakness: CWE-400

Description

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.

Affected products

node-saml passport-saml: before 3.1.0 — fixed in 3.1.0

How to fix

Upgrade to a fixed version: node-saml passport-saml 3.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-39171 or the next vulnerability affects your stack