Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-nodemon | Nov 15, 2022 | Feb 24, 2022 |
| Alpine Linux | — | Upgrade openjdk11Upgrade nodejs-currentUpgrade nodejs | Mar 26, 2024 | Feb 24, 2022 |
| Amazon_linux_2023 | — | Upgrade v8-develUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejsUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-libs-debuginfo | Feb 17, 2025 | Jan 10, 2022 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-nodemon | Nov 9, 2022 | Feb 24, 2022 |
| Debian | — | Upgrade nodejs | Nov 4, 2022 | Feb 24, 2022 |
| Freebsd | — | Upgrade node16Upgrade nodeUpgrade node14 | Nov 4, 2022 | Feb 12, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Feb 24, 2022 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs | Nov 16, 2022 | Jan 10, 2022 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-docs | Nov 9, 2022 | Feb 24, 2022 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18n | Mar 12, 2024 | Feb 24, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.7Upgrade Splunk Enterprise to version 9.2.4Upgrade Splunk Enterprise to version 9.3.2 | Sep 30, 2025 | Feb 24, 2022 |
| Suse | — | Upgrade npm14Upgrade nodejs12-docsUpgrade nodejs14-develUpgrade nodejs16-develUpgrade npm16Upgrade nodejs16Upgrade nodejs12Upgrade nodejs16-docsUpgrade npm12Upgrade nodejs14Upgrade nodejs14-docsUpgrade nodejs12-devel | Jan 19, 2022 | Jan 18, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 24, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub