Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejs | Nov 15, 2022 | Feb 24, 2022 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-currentUpgrade openjdk11 | Mar 26, 2024 | Feb 24, 2022 |
| Amazon_linux_2023 | — | Upgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade v8-develUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejsUpgrade nodejs-devel | Feb 17, 2025 | Jan 10, 2022 |
| Centos_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debuginfo | Nov 9, 2022 | Feb 24, 2022 |
| Debian | — | Upgrade nodejs | Nov 4, 2022 | Feb 24, 2022 |
| Freebsd | — | Upgrade node14Upgrade nodeUpgrade node16 | Nov 4, 2022 | Feb 12, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Feb 24, 2022 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade npmUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-devel | Nov 16, 2022 | Jan 10, 2022 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-full-i18n | Nov 9, 2022 | Feb 24, 2022 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-debuginfo | Mar 12, 2024 | Feb 24, 2022 |
| Suse | — | Upgrade nodejs12-docsUpgrade npm14Upgrade nodejs16-docsUpgrade nodejs14Upgrade nodejs16-develUpgrade npm16Upgrade nodejs14-develUpgrade npm12Upgrade nodejs12Upgrade nodejs12-develUpgrade nodejs14-docsUpgrade nodejs16 | Jan 19, 2022 | Jan 18, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 24, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 24, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub