CVE-2021-22939: Debian Linux

Medium severity, CVSS 5.3. EPSS: 14.7% chance of exploitation in the next 30 days.

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

Affected products

• Debian Debian Linux: version 10.0 only
• Netapp NextGen API: affected versions not specified
• Node.js Node.js: from 12.0.0, before 12.22.5 (fixed in 12.22.5); from 14.0.0, before 14.17.5 (fixed in 14.17.5); from 16.0.0, before 16.6.2 (fixed in 16.6.2)
• Oracle Graalvm: version 20.3.3 only; version 21.2.0 only
• Oracle Jd Edwards Enterpriseone Tools: up to and including 9.2.6.1
• Oracle MySQL Cluster: up to and including 8.0.26
• Oracle PeopleSoft Enterprise PeopleTools: version 8.57 only; version 8.58 only; version 8.59 only
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)

Published 2021-08-16. Last modified 2026-06-17.