UpHeron
All vulnerabilities

Servers and applications

CVE-2021-44533

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject…

Severity
Medium 5.3
Published
24 Feb 2022
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
12.22.9, 14.18.3, 16.13.2, 17.3.1
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • Every version before 12.22.9
  • From 14.0.0 before 14.18.3
  • From 16.0.0 before 16.13.2
  • From 17.0.0 before 17.3.1
MySQLServers and applications · cpe:a:oracle:mysql_server
  • Every version up to 5.7.37
  • From 8.0.0 up to 8.0.28

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-44533
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-44533