Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npm | Nov 15, 2022 | Feb 24, 2022 |
| Alpine Linux | — | Upgrade openjdk11Upgrade nodejs-currentUpgrade nodejs | Mar 26, 2024 | Feb 24, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade v8-develUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade npm | Feb 17, 2025 | Jan 10, 2022 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-packaging | Nov 9, 2022 | Feb 24, 2022 |
| Debian | — | Upgrade nodejs | Nov 4, 2022 | Feb 24, 2022 |
| Freebsd | — | Upgrade nodeUpgrade node14Upgrade node16 | Nov 4, 2022 | Feb 12, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Feb 24, 2022 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-docsUpgrade npmUpgrade nodejs-devel | Nov 16, 2022 | Jan 10, 2022 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18n | Nov 9, 2022 | Feb 24, 2022 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade npm | Mar 12, 2024 | Feb 24, 2022 |
| Suse | — | Upgrade nodejs12-docsUpgrade nodejs16-docsUpgrade nodejs14Upgrade nodejs16Upgrade nodejs16-develUpgrade nodejs12Upgrade npm12Upgrade nodejs14-develUpgrade npm14Upgrade npm16Upgrade nodejs12-develUpgrade nodejs14-docs | Jan 19, 2022 | Jan 18, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 24, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 24, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub