Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: NodeJS Node 10.*, 11.* and 12 more versions Clear all filters
TI-2021-20133 CVE-2021-44533

Improper certificate validation in NodeJS Node

Priority MEDIUM 42

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.09358 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-295
TI-2021-20132 CVE-2021-44532 · GHSA-jg6g-8j59-vr29

Improper certificate validation in NodeJS Node

Priority LOW 37

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.10364 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-296
TI-2021-20131 CVE-2021-44531 · GHSA-5qpf-4xwh-5775

Improper certificate validation in NodeJS Node

Priority MEDIUM 43

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.08373 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-295
TI-2022-06195 CVE-2022-21824 · GHSA-39wv-qjgj-4jxg

Prototype pollution in NodeJS Node

Priority MEDIUM 55

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one proper…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.21514 Published 2022-02-24 Partial fix · 12.22.9, 14.18.3 +2 CWE-471