CVE-2021-44531: Node.js

High severity, CVSS 7.4. EPSS: 8.4% chance of exploitation in the next 30 days.

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.

Affected products

• Node.js Node.js: before 12.22.9 (fixed in 12.22.9); from 14.0.0, before 14.18.3 (fixed in 14.18.3); from 16.0.0, before 16.13.2 (fixed in 16.13.2); from 17.0.0, before 17.3.1 (fixed in 17.3.1)
• Oracle Graalvm: version 20.3.5 only; version 21.3.1 only; version 22.0.0.2 only
• Oracle MySQL Cluster: up to and including 8.0.29
• Oracle MySQL Connectors: up to and including 8.0.28
• Oracle MySQL Enterprise Monitor: up to and including 8.0.29
• Oracle MySQL Server: up to and including 5.7.37; from 8.0.0, up to and including 8.0.28
• Oracle MySQL Workbench: up to and including 8.0.28
• Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only

Published 2022-02-24. Last modified 2026-06-17.