CVE catalog
CVE-2021-31597
UBUNTU-
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
- Severity
- Critical · CVSS 9.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.04% · Oct 27, 2026
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Ubuntu20.04 | node-xmlhttprequest-ssl | 1.6.0-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-31597] |
| Ubuntu18.04 | node-xmlhttprequest-ssl | 1.6.0-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-31597] |
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Ubuntu18.04 | node-xmlhttprequest-ssl | 1.6.0-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-31597] |
| Ubuntu20.04 | node-xmlhttprequest-ssl | 1.6.0-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-31597] |
Original provider fields
{
"package_releases": [],
"fixed_versions": [],
"distribution_packages": [
{
"name": "node-xmlhttprequest-ssl",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "18.04",
"versions": [
"1.6.0-1"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-31597",
"fixed_version": "",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2021-31597",
"provider_updated_at": "2025-10-24T04:50:18Z",
"applicability_unknown": true
},
{
"name": "node-xmlhttprequest-ssl",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "20.04",
"versions": [
"1.6.0-1"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-31597",
"fixed_version": "",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2021-31597",
"provider_updated_at": "2025-10-24T04:50:18Z",
"applicability_unknown": true
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
Observed: