Non notée
CVE-2021-22939 If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no…
Description
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Node 16.0 | 16.0 → < 16.6.2 | 16.6.2 |
| Node 15.0 | 15.0 → dernières | Pas de correctif indiqué |
| Node 14.0 | 14.0 → < 14.17.5 | 14.17.5 |
| Node 13.0 | 13.0 → dernières | Pas de correctif indiqué |
| Node 12.0 | 12.0 → < 12.22.5 | 12.22.5 |
| Node 11.0 | 11.0 → dernières | Pas de correctif indiqué |
| Node 10.0 | 10.0 → dernières | Pas de correctif indiqué |
| Node 9.0 | 9.0 → dernières | Pas de correctif indiqué |
| Node 8.0 | 8.0 → dernières | Pas de correctif indiqué |
Références
- nodejs.org nodejs.org
- hackerone.com hackerone.com
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- www.oracle.com www.oracle.com
- cert-portal.siemens.com cert-portal.siemens.com
- www.oracle.com www.oracle.com
- [debian-lts-announce] 20221005 [SECURITY] [DLA 3137-1] nodejs security update lists.debian.org
- GLSA-202401-02 security.gentoo.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Node
Les 129 CVE de Node →
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard…
3.6
Faible
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Moyenne
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a…
7.4
Élevée
CVE-2026-106069
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP…
7.4
Élevée