Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packaging | Nov 15, 2022 | Feb 24, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-currentUpgrade openjdk11 | Mar 26, 2024 | Feb 24, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade v8-develUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-devel | Feb 17, 2025 | Jan 10, 2022 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs | Nov 9, 2022 | Feb 24, 2022 |
| Debian | — | Upgrade nodejs | Nov 4, 2022 | Feb 24, 2022 |
| Freebsd | — | Upgrade node16Upgrade nodeUpgrade node14 | Nov 4, 2022 | Feb 12, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Feb 24, 2022 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-docs | Nov 16, 2022 | Jan 10, 2022 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade npm | Nov 9, 2022 | Feb 24, 2022 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs | Mar 12, 2024 | Feb 24, 2022 |
| Suse | — | Upgrade npm16Upgrade npm14Upgrade nodejs16-docsUpgrade npm12Upgrade nodejs16-develUpgrade nodejs14Upgrade nodejs12Upgrade nodejs14-develUpgrade nodejs16Upgrade nodejs12-docsUpgrade nodejs14-docsUpgrade nodejs12-devel | Jan 19, 2022 | Jan 18, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 24, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 24, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub