ALPINE-CVE-2021-44531
ALPINE-CVE-2021-44531
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
CVSS 7.4 · High · Fix available
- Published
- Updated
Stack: system
Affected products and versions
nodejs Alpine:v3.12
- Affected ranges
- ECOSYSTEM: < 12.22.10-r0
Update to 12.22.10-r0
nodejs Alpine:v3.13
- Affected ranges
- ECOSYSTEM: < 14.19.0-r0
Update to 14.19.0-r0
nodejs Alpine:v3.14
- Affected ranges
- ECOSYSTEM: < 14.19.0-r0
Update to 14.19.0-r0
nodejs Alpine:v3.15
- Affected ranges
- ECOSYSTEM: < 16.13.2-r0
Update to 16.13.2-r0
nodejs Alpine:v3.16
- Affected ranges
- ECOSYSTEM: < 16.13.2-r0
Update to 16.13.2-r0
nodejs Alpine:v3.17
- Affected ranges
- ECOSYSTEM: < 16.13.2-r0
Update to 16.13.2-r0
nodejs Alpine:v3.18
- Affected ranges
- ECOSYSTEM: < 16.13.2-r0
Update to 16.13.2-r0
nodejs Alpine:v3.19
- Affected ranges
- ECOSYSTEM: < 16.13.2-r0
Update to 16.13.2-r0
nodejs Alpine:v3.20
- Affected ranges
- ECOSYSTEM: < 16.13.2-r0
Update to 16.13.2-r0
nodejs Alpine:v3.21
- Affected ranges
- ECOSYSTEM: < 16.13.2-r0
Update to 16.13.2-r0
nodejs Alpine:v3.22
- Affected ranges
- ECOSYSTEM: < 16.13.2-r0
Update to 16.13.2-r0
nodejs Alpine:v3.23
- Affected ranges
- ECOSYSTEM: < 16.13.2-r0
Update to 16.13.2-r0
nodejs Alpine:v3.24
- Affected ranges
- ECOSYSTEM: < 16.13.2-r0
Update to 16.13.2-r0