CVE-2021-44533: Debian Linux

Medium severity, CVSS 5.3. EPSS: 9.4% chance of exploitation in the next 30 days.

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Affected products

• Debian Debian Linux: version 11.0 only
• Node.js Node.js: before 12.22.9 (fixed in 12.22.9); from 14.0.0, before 14.18.3 (fixed in 14.18.3); from 16.0.0, before 16.13.2 (fixed in 16.13.2); from 17.0.0, before 17.3.1 (fixed in 17.3.1)
• Oracle Graalvm: version 20.3.5 only; version 21.3.1 only; version 22.0.0.2 only
• Oracle MySQL Cluster: before 8.0.29 (fixed in 8.0.29); version 8.0.29 only
• Oracle MySQL Connectors: up to and including 8.0.28
• Oracle MySQL Enterprise Monitor: up to and including 8.0.29
• Oracle MySQL Server: up to and including 5.7.37; from 8.0.0, up to and including 8.0.28
• Oracle MySQL Workbench: up to and including 8.0.28
• Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only

Published 2022-02-24. Last modified 2026-10-08.