{"id":"CVE-2021-44533","title":"Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly","summary":"Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be inter…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-295"],"vendor":"nodejs","product":"node.js","affected":["node.js < 12.22.9","node.js >= 14.0.0, < 14.18.3","node.js >= 16.0.0, < 16.13.2","node.js >= 17.0.0, < 17.3.1","graalvm = 20.3.5","graalvm = 21.3.1","graalvm = 22.0.0.2","mysql_cluster < 8.0.29","mysql_cluster = 8.0.29","mysql_connectors <= 8.0.28","mysql_enterprise_monitor <= 8.0.29","mysql_server <= 5.7.37","mysql_server >= 8.0.0, <= 8.0.28","mysql_workbench <= 8.0.28","peoplesoft_enterprise_peopletools = 8.58","peoplesoft_enterprise_peopletools = 8.59","debian_linux = 11.0"],"patched":["node.js 17.3.1","mysql_cluster 8.0.29"],"published":"2022-02-24","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:17:13.950","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-44533","references":[{"url":"https://hackerone.com/reports/1429694","label":"support@hackerone.com"},{"url":"https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/","label":"support@hackerone.com"},{"url":"https://security.netapp.com/advisory/ntap-20220325-0007/","label":"support@hackerone.com"},{"url":"https://www.debian.org/security/2022/dsa-5170","label":"support@hackerone.com"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"support@hackerone.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"support@hackerone.com"},{"url":"https://hackerone.com/reports/1429694","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20220325-0007/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2022/dsa-5170","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-44533.json"},{"url":"https://access.redhat.com/security/cve/CVE-2021-44533"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040856"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44533"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44533"},{"url":"https://access.redhat.com/errata/RHSA-2022:4914"},{"url":"https://access.redhat.com/errata/RHSA-2022:7044"},{"url":"https://access.redhat.com/errata/RHSA-2023:3742"},{"url":"https://access.redhat.com/errata/RHEA-2022:4925"},{"url":"https://access.redhat.com/errata/RHEA-2022:5221"},{"url":"https://access.redhat.com/errata/RHEA-2022:5615"},{"url":"https://access.redhat.com/errata/RHSA-2023:1742"},{"url":"https://access.redhat.com/errata/RHEA-2022:5139"},{"url":"https://access.redhat.com/errata/RHSA-2022:7830"},{"url":"https://access.redhat.com/errata/RHSA-2022:9073"}],"tags":["nvd","csaf","vex","red-hat","cve.org","score-dispute"],"epss":0.09358,"epssPercentile":0.95365,"ingestedAt":"2026-10-08T23:16:47.333Z","scores":{"nvd":5.3,"vendor":7.4},"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-08T21:15:41.447359Z"},"slug":"CVE-2021-44533","body":"## Overview\n\nNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.\n\n## Affected\n\n- `node.js < 12.22.9`\n- `node.js >= 14.0.0, < 14.18.3`\n- `node.js >= 16.0.0, < 16.13.2`\n- `node.js >= 17.0.0, < 17.3.1`\n- `graalvm = 20.3.5`\n- `graalvm = 21.3.1`\n- `graalvm = 22.0.0.2`\n- `mysql_cluster < 8.0.29`\n- `mysql_cluster = 8.0.29`\n- `mysql_connectors <= 8.0.28`\n- `mysql_enterprise_monitor <= 8.0.29`\n- `mysql_server <= 5.7.37`\n- `mysql_server >= 8.0.0, <= 8.0.28`\n- `mysql_workbench <= 8.0.28`\n- `peoplesoft_enterprise_peopletools = 8.58`\n- `peoplesoft_enterprise_peopletools = 8.59`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `node.js 17.3.1`\n- `mysql_cluster 8.0.29`\n\n## Vendor advisories\n\n- **RHSA-2022:4914** · Red Hat · fixed in: Red Hat Software Collections for RHEL Workstation(v. 7), Red Hat Software Collections for RHEL(v. 7) · released 2022-06-06 · [advisory](https://access.redhat.com/errata/RHSA-2022:4914)\n- **RHSA-2022:7044** · Red Hat · fixed in: Red Hat Software Collections for RHEL Workstation(v. 7), Red Hat Software Collections for RHEL(v. 7) · released 2022-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2022:7044)\n- **RHSA-2023:3742** · Red Hat · fixed in: RHODF 4.13 for RHEL 9 · released 2023-06-21 · [advisory](https://access.redhat.com/errata/RHSA-2023:3742)\n- **RHEA-2022:4925** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v. 8.1) · released 2022-06-07 · [advisory](https://access.redhat.com/errata/RHEA-2022:4925)\n- **RHEA-2022:5221** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 8.2) · released 2022-06-28 · [advisory](https://access.redhat.com/errata/RHEA-2022:5221)\n- **RHEA-2022:5615** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.8.4) · released 2022-07-19 · [advisory](https://access.redhat.com/errata/RHEA-2022:5615)\n- **RHSA-2023:1742** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.8.6) · released 2023-04-12 · [advisory](https://access.redhat.com/errata/RHSA-2023:1742)\n- **RHEA-2022:5139** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2022-06-21 · [advisory](https://access.redhat.com/errata/RHEA-2022:5139)\n- **RHSA-2022:7830** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2022-11-08 · [advisory](https://access.redhat.com/errata/RHSA-2022:7830)\n- **RHSA-2022:9073** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2022-12-15 · [advisory](https://access.redhat.com/errata/RHSA-2022:9073)\n- **Red Hat VEX** · Moderate · affected: Red Hat Quay 3 · no fix planned: Red Hat Quay 3 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-44533.json)","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":29.2,"likelihood":1.9,"exploitation":0,"ransomware":0},"changes":[]}