Accepting arbitrary Subject Alternative Name (SAN) types unless a PKI is specifically defined to use a particular SAN type can result in bypassing name-constrained intermediates. Node.js < 12.22.9 < 14.18.3 < 16.13.2 and < 17.3.1 was accepting URI SAN types which PKIs are often not defined to use. Additionally when a protocol allows URI SANs Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.

🗓️ 08 Mar 2022 08:00:00Reported by MicrosoftType

Arbitrary SAN types may bypass constraints; Node.js fixes disable URI SANs; revert with --security-revert.

Reporter	Title	Published	Views	Family All 395
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in node.js	14 Apr 202215:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	25 Oct 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway affected by vulnerability in Node (CVE-2021-44531)	29 Jul 202218:37	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of NodeJS, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple security vulnerabilities.	5 Sep 202311:07	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple CVEs in Node.js	8 Apr 202214:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in PostgreSQL, Node.js, and Data Tables from Spry Media may affect IBM Spectrum Protect Plus	31 Jan 202218:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	15 Jul 202516:38	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilites that affect IBM Engineering Requirements Quality Assistant On-Premises (CVE-2021-4104, CVE-2021-29469, CVE-2021-44531, CVE-2021-44531, CVE-2022-21824, CVE-2021-29899, CVE-2021-27290 )	17 Mar 202215:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions due to CVE-2021-44531	4 Nov 202216:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js	22 Aug 202215:20	–	ibm

Vulners

Node

microsoft cbl2_nodejs_16.14.0-1Range<16.14.0-1

microsoft cm1_nodejs_14.18.3-1Range<14.18.3-1

08 Mar 2022 08:00Current

7.1High risk

Vulners AI Score7.1

CVSS 25.8

CVSS 3.17.4

EPSS0.00076