CVE-2021-39171: Passport-SAML Project Passport-SAML

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.

Affected products

• Passport-SAML Project Passport-SAML: before 3.1.0 (fixed in 3.1.0)

Published 2021-08-27. Last modified 2026-06-17.