Skip to content
Fencer Intel
medium 5.3

CVE-2021-44533 json

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.

published 4y ago modified last mo. also BIT-node-2021-44533 , BIT-node-min-2021-44533 , EUVD-2021-31364

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
9.4%
EPSS 9.4% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Patch / fix

  • bitnami node 12.22.9, 14.18.3, 16.13.2, 17.3.1
  • bitnami node-min 12.22.9, 14.18.3, 16.13.2, 17.3.1
  • NodeJS Node 12.22.9, 14.18.3, 16.13.2, 17.3.1
  • nodejs Debian 14, Debian 13, Debian 12 12.22.9~dfsg-1

debian advisories DEBIAN-CVE-2021-44533

  • nodejs-packaging RHEL 8, RHEL 8.6 EUS 23-3.module+el8.3.0+6519+9f98ed83
  • npm RHEL 8 1:8.19.2-1.16.18.1.3.module+el8.7.0+17465+1a1abd74
  • nodejs RHEL 8 1:16.18.1-3.module+el8.7.0+17465+1a1abd74
  • nodejs-nodemon RHEL 8 2.0.20-2.module+el8.7.0+17412+bb0e4a6b
  • nodejs-full-i18n RHEL 8 1:16.18.1-3.module+el8.7.0+17465+1a1abd74
  • nodejs-packaging RHEL 8 25-1.module+el8.5.0+10992+fac5fe06
  • npm RHEL 8 1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d
  • nodejs RHEL 8 1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d

red hat advisories RHSA-2023:1742RHSA-2022:9073RHEA-2022:5139RHEA-2022:5221RHEA-2022:5615RHEA-2022:4925

  • nodejs14 SLE Module for Web and Scripting 12 14.18.3-6.21.1
  • nodejs12 SLE Module for Web and Scripting 15 SP3 12.22.9-4.25.1
  • nodejs14 SLE Module for Web and Scripting 15 SP3 14.18.3-15.24.1
  • nodejs12 SLE Module for Web and Scripting 12 12.22.9-1.38.1

suse advisories SUSE-SU-2022:0114-1SUSE-SU-2022:0113-1SUSE-SU-2022:0112-1SUSE-SU-2022:0101-1

  • nodejs17 openSUSE Tumbleweed 17.3.1-1.1
  • nodejs16 openSUSE Tumbleweed 16.13.2-1.1
  • nodejs12 openSUSE Leap 15.3 12.22.9-4.25.1
  • htmldoc Package Hub 15 SP3, openSUSE Leap 15.3 1.9.12-bp153.2.9.1
  • nodejs14 openSUSE Leap 15.3 14.18.3-15.24.1
  • chromium Package Hub 15 SP3, openSUSE Leap 15.3 100.0.4896.88-bp153.2.82.1

opensuse advisories openSUSE-SU-2024:11730-1openSUSE-SU-2024:11746-1openSUSE-SU-2022:0113-1openSUSE-SU-2022:0112-1

  • npm AlmaLinux 8 1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db
  • nodejs AlmaLinux 8 1:16.18.1-3.module_el8.7.0+3371+ed8c43db
  • nodejs-nodemon AlmaLinux 8 2.0.20-2.module_el8.7.0+3371+ed8c43db
  • nodejs-full-i18n AlmaLinux 8 1:16.18.1-3.module_el8.7.0+3371+ed8c43db
  • nodejs-packaging AlmaLinux 8 25-1.module_el8.5.0+2605+45d748af
  • npm AlmaLinux 8 1:6.14.17-1.14.20.1.2.module_el8.7.0+3342+b2df8497
  • nodejs AlmaLinux 8 1:14.20.1-2.module_el8.7.0+3342+b2df8497
  • nodejs-nodemon AlmaLinux 8 2.0.19-2.module_el8.6.0+3261+490666b3

almalinux advisories ALSA-2022:9073ALSA-2022:7830

  • nodejs Rocky Linux 8 1:16.18.1-3.module+el8.7.0+1108+49363b0d
  • nodejs-nodemon Rocky Linux 8 2.0.20-2.module+el8.7.0+1108+49363b0d
  • nodejs-packaging Rocky Linux 8 25-1.module+el8.6.0+1046+80feca58
  • nodejs-packaging Rocky Linux 8 25-1.module+el8.5.0+702+221f14e6
  • nodejs Rocky Linux 8 1:14.20.1-2.module+el8.7.0+1071+4bdda2a8
  • nodejs-nodemon Rocky Linux 8 2.0.19-2.module+el8.6.0+1046+80feca58
  • nodejs-nodemon Rocky Linux 8 2.0.19-2.module+el8.6.0+1003+ae94235a
  • nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8

rocky linux advisories RLSA-2022:9073RLSA-2022:7830

  • nodejs Alpine 3.12 12.22.10-r0
  • nodejs Alpine 3.14, Alpine 3.13 14.19.0-r0
  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 16.13.2-r0
  • openjdk11 Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 11.0.15_p10-r0
  • nodejs-current Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 17.3.1-r0

alpine advisories ALPINE-CVE-2021-44533

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nodejs CBL-Mariner 2.0 16.14.0-1

azure linux advisories AZL-8819

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2021-44533 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-44533 updated cvss 7.4

nodejs: Incorrect handling of certificate subject and issuer fields

  • Red Hat Quay 3 nodejs
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 14.20.1-2.module+el8.7.0+16991+b0a68a3e, nodejs 16.18.1-3.module+el8.7.0+17465+1a1abd74, nodejs 12.22.12-1.module+el8.6.0+15324+1f2c5d8d, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-packaging 25-1.module+el8.5.0+10992+fac5fe06, +9 more
    fixed: vendor fix RHEA-2022:5139
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) nodejs 12.22.12-1.module+el8.1.0+15296+87b2f6ad, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-nodemon 1.18.3-1.module+el8.1.0+3369+37ae6a45, npm 6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad, nodejs-full-i18n 12.22.12-1.module+el8.1.0+15296+87b2f6ad
    fixed: vendor fix RHEA-2022:4925
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) nodejs 12.22.12-1.module+el8.2.0+15322+a70ca0ab, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-nodemon 1.18.3-1.module+el8.1.0+3369+37ae6a45, npm 6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab, nodejs-full-i18n 12.22.12-1.module+el8.2.0+15322+a70ca0ab
    fixed: vendor fix RHEA-2022:5221
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs 12.22.12-1.module+el8.4.0+15323+4d1cc445, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, nodejs-nodemon 2.0.3-1.module+el8.4.0+11732+c668cc9f, npm 6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445, nodejs-full-i18n 12.22.12-1.module+el8.4.0+15323+4d1cc445
    fixed: vendor fix RHEA-2022:5615
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs 14.21.3-1.module+el8.6.0+18532+cbe6f646, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.20-3.module+el8.6.0+18532+cbe6f646, npm 6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646, nodejs-full-i18n 14.21.3-1.module+el8.6.0+18532+cbe6f646
    fixed: vendor fix RHSA-2023:1742
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-nodejs14-nodejs 14.20.1-2.el7, rh-nodejs12-nodejs 12.22.12-2.el7, rh-nodejs14-npm 6.14.17-14.20.1.2.el7, rh-nodejs12-npm 6.14.16-12.22.12.2.el7 Red Hat Software Collections for RHEL(v. 7) rh-nodejs14-nodejs 14.20.1-2.el7, rh-nodejs12-nodejs 12.22.12-2.el7, rh-nodejs14-npm 6.14.17-14.20.1.2.el7, rh-nodejs12-npm 6.14.16-12.22.12.2.el7
    fixed: vendor fix RHSA-2022:4914
  • Red Hat RHODF 4.13 for RHEL 9 odf4/mcg-core-rhel9 v4.13.0-41
    fixed: vendor fix RHSA-2023:3742
show 1 more
  • Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat RHODF 4.13 for RHEL 9 odf4/cephcsi-rhel9 v4.13.0-35, odf4/mcg-cli-rhel9 v4.13.0-17, odf4/odf-console-rhel9 v4.13.0-85, odf4/mcg-rhel9-operator v4.13.0-41, odf4/ocs-rhel9-operator v4.13.0-67, odf4/odf-rhel9-operator v4.13.0-24, +17 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
last mo.

Exploit prediction

9.36% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • hackerone.com https://hackerone.com/reports/1429694 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami node
<12.22.9
>=14.0.0, <14.18.3
>=16.0.0, <16.13.2
>=17.0.0, <17.3.1
12.22.9
14.18.3
16.13.2
17.3.1
bitnami node-min
<12.22.9
>=14.0.0, <14.18.3
>=16.0.0, <16.13.2
>=17.0.0, <17.3.1
12.22.9
14.18.3
16.13.2
17.3.1

Affected products

  • NodeJS Node

Classification

Weakness
  • CWE-295 Improper Certificate Validation
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.