CVE catalog
CVE-2021-44532
nodejs: CVE-2021-44532
- Severity
- High · CVSS 7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 10.36% · Oct 25, 2026
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | nodejs | sid | 24.22.1+dfsg+~cs24.19.2-1 | fixed |
| Debian | nodejs | forky | 24.21.0+dfsg+~cs24.13.4-1 | fixed |
| Debian | nodejs | trixie | 20.19.2+dfsg-1+deb13u2 | fixed |
| Debian | nodejs | trixie-security | 20.19.2+dfsg-1+deb13u3 | fixed |
| Debian | nodejs | bookworm | 18.20.4+dfsg-1~deb12u2 | fixed |
| Debian | nodejs | bookworm-security | 18.20.4+dfsg-1~deb12u3 | fixed |
| Alpine | nodejs | 3.12 | 12.22.10-r0 | fixed |
| Alpine | nodejs | 3.13 | 14.19.0-r0 | fixed |
| Alpine | nodejs | 3.14 | 14.19.0-r0 | fixed |
| Alpine | nodejs | 3.15 | 16.13.2-r0 | fixed |
| Alpine | nodejs | 3.16 | 16.13.2-r0 | fixed |
| Alpine | nodejs | 3.17 | 16.13.2-r0 | fixed |
| Alpine | nodejs | 3.18 | 16.13.2-r0 | fixed |
| Alpine | nodejs | 3.19 | 16.13.2-r0 | fixed |
| Alpine | nodejs | 3.20 | 16.13.2-r0 | fixed |
| Alpine | nodejs | 3.21 | 16.13.2-r0 | fixed |
| Alpine | nodejs | 3.22 | 16.13.2-r0 | fixed |
| Alpine | nodejs | 3.23 | 16.13.2-r0 | fixed |
| Alpine | nodejs | 3.24 | 16.13.2-r0 | fixed |
| Ubuntu | nodejs | pro | 12.22.5~dfsg-5ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.7~dfsg-2ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.7~dfsg-2ubuntu3 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu2 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.1 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.2 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.3 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.4 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.5 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.6 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.6+esm2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | nodejs | source | sid | 12.22.9~dfsg-1 | not yet assigned | Not reported | [1004177] |
| Debian | nodejs | source | forky | 12.22.9~dfsg-1 | not yet assigned | Not reported | [1004177] |
| Debian | nodejs | source | trixie | 12.22.9~dfsg-1 | not yet assigned | Not reported | [1004177] |
| Debian | nodejs | source | bookworm | 12.22.9~dfsg-1 | not yet assigned | Not reported | [1004177] |
| Alpine | nodejs | apk | 3.12 | 12.22.10-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.13 | 14.19.0-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.14 | 14.19.0-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.15 | 16.13.2-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.16 | 16.13.2-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.17 | 16.13.2-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.18 | 16.13.2-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.19 | 16.13.2-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.20 | 16.13.2-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.21 | 16.13.2-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.22 | 16.13.2-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.23 | 16.13.2-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
| Alpine | nodejs | apk | 3.24 | 16.13.2-r0 | Not reported | ALPINE-CVE-2021-44532 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [libnode108]Unknown
Source package: [nodejs]
Details (4)
18.20.4+dfsg-1~deb12u2· amd64 · bookwormFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookwormFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· amd64 · bookworm-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookworm-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- [libnode-dev]Unknown
Source package: [nodejs]
Details (4)
18.20.4+dfsg-1~deb12u2· amd64 · bookwormFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookwormFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· amd64 · bookworm-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookworm-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- [nodejs]Unknown
Details (4)
18.20.4+dfsg-1~deb12u2· amd64 · bookwormFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookwormFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· amd64 · bookworm-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· arm64 · bookworm-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
- [nodejs-doc]Unknown
Source package: [nodejs]
Details (4)
18.20.4+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
18.20.4+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · bookworm; dsa · nodejs · debian · 12
[Debian 13 (Trixie)]
- [libnode115]Unknown
Source package: [nodejs]
Details (5)
20.19.2+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixie-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· amd64 · trixie-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
- [libnode-dev]Unknown
Source package: [nodejs]
Details (5)
20.19.2+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixie-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· amd64 · trixie-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
- [nodejs]Unknown
Details (5)
20.19.2+dfsg-1+deb13u2· amd64 · trixieFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixieFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· amd64 · trixie-security · Historical versionFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· arm64 · trixie-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· amd64 · trixie-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
- [nodejs-doc]Unknown
Source package: [nodejs]
Details (5)
20.19.2+dfsg-1+deb13u2· all · trixieFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· all · trixieFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· all · trixie-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u2· all · trixie-security · Historical versionFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
20.19.2+dfsg-1+deb13u3· all · trixie-securityFixed · Fixed:
12.22.9~dfsg-1dsa · nodejs · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhea-2022_5139.json]
- [https://osv.dev/vulnerability/ALPINE-CVE-2021-44532]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-44532]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2021-44532]
- [https://security-tracker.debian.org/tracker/CVE-2021-44532]
- [https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-44532.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0794.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]