CVE-2021-44531

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-24 · updated 2026-06-17
Weakness: CWE-295

Description

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.

Affected products

Node.js: before 12.22.9; from 14.0.0 before 14.18.3; from 16.0.0 before 16.13.2; from 17.0.0 before 17.3.1 — fixed in 12.22.9, 14.18.3, 16.13.2, 17.3.1
Oracle Corporation GraalVM Enterprise Edition: 20.3.5, 21.3.1, 22.0.0.2
Oracle Corporation MySQL Cluster: through 8.0.29
Oracle Mysql Connectors: through 8.0.28
Oracle Corporation MySQL Enterprise Monitor: through 8.0.29
MySQL Server: through 5.7.37; from 8.0.0 through 8.0.28
Oracle Corporation MySQL Workbench: through 8.0.28
Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59

How to fix

Upgrade to a fixed version: Node.js 12.22.9, 14.18.3, 16.13.2, 17.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-44531 or the next vulnerability affects your stack