Search for vulnerabilities
Vulnerability details: VCID-bhe9-kf8b-aaaf
Vulnerability ID VCID-bhe9-kf8b-aaaf
Aliases CVE-2021-44532
Summary Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
Status Published
Exploitability 0.5
Weighted Severity 6.7
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-295 Improper Certificate Validation
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2022:4914
cvssv3 7.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-44532.json
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00119 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00119 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00119 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00119 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00119 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00119 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00132 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00132 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00132 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00132 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00132 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00132 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00132 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00179 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00179 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00287 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00287 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00287 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00406 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.00538 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
epss 0.09721 https://api.first.org/data/v1/epss?cve=CVE-2021-44532
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=2040846
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2021-44532
cvssv3 5.3 https://nvd.nist.gov/vuln/detail/CVE-2021-44532
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2021-44532
cvssv3.1 5.3 https://www.oracle.com/security-alerts/cpuapr2022.html
generic_textual MODERATE https://www.oracle.com/security-alerts/cpuapr2022.html
cvssv3.1 7.5 https://www.oracle.com/security-alerts/cpujul2022.html
generic_textual HIGH https://www.oracle.com/security-alerts/cpujul2022.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-44532.json
https://api.first.org/data/v1/epss?cve=CVE-2021-44532
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44533
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21824
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://hackerone.com/reports/1429694
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
https://security.netapp.com/advisory/ntap-20220325-0007/
https://www.debian.org/security/2022/dsa-5170
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
1004177 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004177
2040846 https://bugzilla.redhat.com/show_bug.cgi?id=2040846
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
CVE-2021-44532 https://nvd.nist.gov/vuln/detail/CVE-2021-44532
GLSA-202405-29 https://security.gentoo.org/glsa/202405-29
RHSA-2022:4914 https://access.redhat.com/errata/RHSA-2022:4914
RHSA-2022:7044 https://access.redhat.com/errata/RHSA-2022:7044
RHSA-2022:7830 https://access.redhat.com/errata/RHSA-2022:7830
RHSA-2022:9073 https://access.redhat.com/errata/RHSA-2022:9073
RHSA-2023:1742 https://access.redhat.com/errata/RHSA-2023:1742
RHSA-2023:3742 https://access.redhat.com/errata/RHSA-2023:3742
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-44532.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-44532
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-44532
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2021-44532
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://www.oracle.com/security-alerts/cpuapr2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://www.oracle.com/security-alerts/cpujul2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.28422
EPSS Score 0.00097
Published At April 23, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.