CVE-2021-22939 is a medium-severity vulnerability affecting Node.js, Debian, NetApp, Oracle, and Siemens products. It arises when the Node.js https API is incorrectly used with an "undefined" value for the "rejectUnauthorized" parameter, leading to the acceptance of connections to servers with expired certificates without error. This vulnerability has a CVSS score of 5.3, indicating a network-based attack with low complexity and a potential impact of low integrity. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 12.0, < 12.22.5CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 14.0, < 14.17.5CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 16.0, < 16.6.2CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 12.0.0, < 12.22.5CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | ||
>= 14.0.0, < 14.17.5CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
nodejs: Incomplete validation of tls rejectUnauthorized parameter
Aug 11, 2021If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter no error was returned and connections to servers with an expired certificate would have been accepted.
Aug 10, 2021