LiveActive security incident?Get immediate response
CVE Record

CVE-2021-44532: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string...

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-44532 affects Node.js certificate checking. Certain crafted certificate name fields could confuse hostname validation when certificate name constraints are involved, potentially letting a connection appear trusted when it should be rejected. This matters most where Node.js protects sensitive outbound or inbound TLS connections.

Executive priority

Prioritize remediation where Node.js is part of security-sensitive TLS communication or bundled in externally supported platforms. The issue can undermine certificate trust, but the sources do not indicate active exploitation or broad unauthenticated compromise.

Technical view

Affected Node.js versions converted Subject Alternative Names into a string for peer certificate hostname checks. That string format allowed injection when certificate-chain name constraints were present, bypassing those constraints. Node.js fixed this by escaping problematic SAN characters; the fix could be reverted with the documented --security-revert option.

Likely exposure

Exposure is likely in systems running Node.js below 12.22.9, 14.18.3, 16.13.2, or 17.3.1, especially applications relying on TLS certificate hostname verification. Bundled Node.js in vendor products may also matter, as reflected by Oracle, NetApp, and Debian advisories.

Exploitation context

The provided bundle does not show CISA KEV listing or active exploitation. Practical abuse depends on certificate-chain conditions involving name constraints and a target using vulnerable Node.js certificate validation. Treat as a trust-boundary issue, not a general remote code execution vulnerability.

Researcher notes

Key evidence is Node.js SAN string conversion and name-constraint bypass. Validate version exposure and whether certificate verification paths use affected Node.js behavior. Avoid assuming exploitability without certificate-chain context and application-specific TLS trust requirements.

Mitigation direction

  • Upgrade Node.js to a fixed or later supported release.
  • Check vendor advisories for products bundling Node.js.
  • Ensure --security-revert is not enabling the old SAN handling.
  • Prioritize systems handling sensitive TLS connections.
  • Retire unsupported Node.js versions where no vendor fix is available.

Validation and detection

  • Inventory Node.js versions across servers, containers, CI, and serverless runtimes.
  • Confirm runtimes meet fixed version thresholds or later supported releases.
  • Review process flags for --security-revert usage.
  • Identify applications relying on Node.js TLS hostname validation.
  • Check Oracle, NetApp, and Debian advisories for packaged exposure.
Prepared
Confidence
high
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-296: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-44532 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
NodeJSNode4.0, 5.0, 6.0, 7.0, 8.0, 9.0, 10.0, 11.0, 12.0, 13.0, 14.0, 15.0, 16.0, 17.0unaffected
Weakness

CWE details

CWE-296

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-296 · source CWE mapping

Improper Following of a Certificate's Chain of Trust

Improper Following of a Certificate's Chain of Trust represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs