Insecure digital certificates In nodejs
Description
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.12 | 12.22.10-r0 | ||
alpine v3.13 | 14.19.0-r0 | ||
alpine v3.18 | 16.13.2-r0 | ||
 debian 11 | 12.22.12~dfsg-1~deb11u1 | ||
alpine v3.22 | 16.13.2-r0 | ||
alpine v3.14 | 14.19.0-r0 | ||
alpine v3.15 | 16.13.2-r0 | ||
alpine v3.16 | 16.13.2-r0 | ||
alpine v3.17 | 16.13.2-r0 | ||
alpine v3.19 | 16.13.2-r0 |
1-10 of 23
10
Aliases
References