What’s Vulnerable › Vulnerabilities

CVE-2021-44533

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-24 · updated 2026-10-08
• Weakness: CWE-295

Description

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Affected products

• Debian Linux: 11.0
• Node.js: before 12.22.9; from 14.0.0 before 14.18.3; from 16.0.0 before 16.13.2; from 17.0.0 before 17.3.1 — fixed in 12.22.9, 14.18.3, 16.13.2, 17.3.1
• Oracle Corporation GraalVM Enterprise Edition: 20.3.5, 21.3.1, 22.0.0.2
• Oracle Corporation MySQL Cluster: before 8.0.29; 8.0.29 — fixed in 8.0.29
• Oracle Mysql Connectors: through 8.0.28
• Oracle Corporation MySQL Enterprise Monitor: through 8.0.29
• MySQL Server: through 5.7.37; from 8.0.0 through 8.0.28
• Oracle Corporation MySQL Workbench: through 8.0.28
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59

How to fix

Upgrade to a fixed version: Node.js 12.22.9, 14.18.3, 16.13.2, 17.3.1; Oracle Corporation MySQL Cluster 8.0.29. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/1429694
• https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
• https://security.netapp.com/advisory/ntap-20220325-0007/
• https://www.debian.org/security/2022/dsa-5170
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://hackerone.com/reports/1429694
• https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
• https://security.netapp.com/advisory/ntap-20220325-0007/
• https://www.debian.org/security/2022/dsa-5170
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2021-44533 or the next vulnerability affects your stack