[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwTfbr2AlgTNNNz2lDRT_D_I1QMyoDxaA1fns5UKv2mM":3,"g5a-risk:CVE-2021-44532":227},{"success":4,"data":5,"meta":225},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":38,"epssPercentile":26,"epssTimeSeries":39,"severity":40,"affectedProducts":41,"affectedProductsCount":85,"references":86,"referencesCount":116,"weaknesses":117,"weaknessesCount":131,"isActivelyExploited":132,"cisaInfo":26,"otxData":26,"relatedBlogPosts":133,"seoMetadata":134,"configurations":159,"relatedVendorCves":216,"notableEvents":217},"CVE-2021-44532","What is CVE-2021-44532?","Node.js \u003C 12.22.9, \u003C 14.18.3, \u003C 16.13.2, and \u003C 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.","Node.js \u003C 12.22.9, \u003C 14.18.3, \u003C 16.13.2, and \u003C 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certifi...","2022-02-24T19:15:09.36","2022-10-05T14:00:39.58",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":29,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":22,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":23,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","MEDIUM",null,3.9,1.4,[30],{"Source":17,"Type":18,"CVSSData":31,"BaseSeverity":25,"ExploitabilityScore":36,"ImpactScore":37,"ACInsufInfo":26,"ObtainAllPrivilege":26,"ObtainUserPrivilege":26,"ObtainOtherPrivilege":26,"UserInteractionRequired":26},{"Version":32,"VectorString":33,"AccessVector":21,"AccessComplexity":22,"Authentication":23,"ConfidentialityImpact":23,"IntegrityImpact":34,"AvailabilityImpact":23,"BaseScore":35,"BaseSeverity":26,"Exploitability":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"CollateralDamagePotential":26,"TargetDistribution":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"EnvironmentalScore":26},"2.0","AV:N\u002FAC:L\u002FAu:N\u002FC:N\u002FI:P\u002FA:N","PARTIAL",5,10,2.9,0.10364,[38,38,38,38,38,38,38],"Medium",[42,47,52,55,58,61,64,67,70,73,77,80],{"vendor":43,"product":44,"version":45,"criteria":46,"vulnerable":4},"nodejs","node.js","*","cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",{"vendor":48,"product":49,"version":50,"criteria":51,"vulnerable":4},"oracle","graalvm","20.3.5","cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:*",{"vendor":48,"product":49,"version":53,"criteria":54,"vulnerable":4},"21.3.1","cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*",{"vendor":48,"product":49,"version":56,"criteria":57,"vulnerable":4},"22.0.0.2","cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*",{"vendor":48,"product":59,"version":45,"criteria":60,"vulnerable":4},"mysql_cluster","cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*",{"vendor":48,"product":62,"version":45,"criteria":63,"vulnerable":4},"mysql_connectors","cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*",{"vendor":48,"product":65,"version":45,"criteria":66,"vulnerable":4},"mysql_enterprise_monitor","cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",{"vendor":48,"product":68,"version":45,"criteria":69,"vulnerable":4},"mysql_server","cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*",{"vendor":48,"product":71,"version":45,"criteria":72,"vulnerable":4},"mysql_workbench","cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*",{"vendor":48,"product":74,"version":75,"criteria":76,"vulnerable":4},"peoplesoft_enterprise_peopletools","8.58","cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",{"vendor":48,"product":74,"version":78,"criteria":79,"vulnerable":4},"8.59","cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*",{"vendor":81,"product":82,"version":83,"criteria":84,"vulnerable":4},"debian","debian_linux","11.0","cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",12,[87,93,100,104,108,113],{"url":88,"source":89,"tags":90},"https:\u002F\u002Fhackerone.com\u002Freports\u002F1429694","Hackerone",[91,92],"Mitigation","Third Party Advisory",{"url":94,"source":95,"tags":96},"https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Fjan-2022-security-releases\u002F","Nodejs",[97,98,99],"Exploit","Release Notes","Vendor Advisory",{"url":101,"source":102,"tags":103},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20220325-0007\u002F","Netapp",[92],{"url":105,"source":106,"tags":107},"https:\u002F\u002Fwww.debian.org\u002Fsecurity\u002F2022\u002Fdsa-5170","Debian",[92],{"url":109,"source":110,"tags":111},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpuapr2022.html","Oracle",[112,92],"Patch",{"url":114,"source":110,"tags":115},"https:\u002F\u002Fwww.oracle.com\u002Fsecurity-alerts\u002Fcpujul2022.html",[92],6,[118,126],{"id":119,"name":120,"description":121,"extendedDescription":122,"status":123,"abstraction":124,"structure":125},"CWE-295","Improper Certificate Validation","The product does not validate, or incorrectly validates, a certificate.","When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.","Draft","Base","Simple",{"id":127,"name":128,"description":129,"extendedDescription":130,"status":123,"abstraction":124,"structure":125},"CWE-296","Improper Following of a Certificate's Chain of Trust","The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.","If a system does not follow the chain of trust of a certificate to a root server, the certificate loses all usefulness as a metric of trust. Essentially, the trust gained from a certificate is derived from a chain of trust -- with a reputable trusted entity at the end of that list. The end user must trust that reputable source, and this reputable source must vouch for the resource in question through the medium of the certificate.\nIn some cases, this trust traverses several entities who vouch for one another. The entity trusted by the end user is at one end of this trust chain, while the certificate-wielding resource is at the other end of the chain. If the user receives a certificate at the end of one of these trust chains and then proceeds to check only that the first link in the chain, no real trust has been derived, since the entire chain must be traversed back to a trusted source to verify the certificate.\nThere are several ways in which the chain of trust might be broken, including but not limited to:",2,false,[],{"title":135,"metaDescription":136,"keywords":137,"canonicalUrl":138,"structuredData":139},"What is CVE-2021-44532? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2021-44532, a medium severity cyber security vulnerability from 2022. Node.js \u003C 12.22.9, \u003C 14.18.3, \u003C 16.13.2, and \u003C 17.3.1 con...","CVE-2021-44532, CVE-2021-44532 vulnerability, CVE-2021-44532 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2022, CVSS score, exploit, patch, remediation, nodejs security, oracle security, node.js vulnerability, graalvm vulnerability, mysql_cluster vulnerability, mysql_connectors vulnerability, mysql_enterprise_monitor vulnerability","\u002Fwhat-is\u002Fcve-2021-44532",{"@context":140,"@type":141,"headline":135,"description":136,"datePublished":10,"dateModified":11,"author":142,"publisher":146,"about":150,"mainEntityOfPage":154,"articleSection":157,"keywords":158},"https:\u002F\u002Fschema.org","TechArticle",{"@type":143,"name":144,"url":145},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":143,"name":144,"url":145,"logo":147},{"@type":148,"url":149},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":151,"name":6,"description":152,"additionalType":153},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":155,"@id":156},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2021-44532","Cybersecurity","CVE-2021-44532, CVE-2021-44532 vulnerability, CVE-2021-44532 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[160,180,210],{"Operator":26,"Negate":26,"Nodes":161},[162],{"Operator":163,"Negate":26,"CPEMatch":164},"OR",[165,168,172,176],{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":166,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":167,"VersionEndIncluding":26},"DAE16BC9-7B14-48DA-ADEB-D1898E0B9885","12.22.9",{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":169,"VersionStartExcluding":26,"VersionStartIncluding":170,"VersionEndExcluding":171,"VersionEndIncluding":26},"8499B085-A803-4958-BB99-8E7FABB177BB","14.0.0","14.18.3",{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":173,"VersionStartExcluding":26,"VersionStartIncluding":174,"VersionEndExcluding":175,"VersionEndIncluding":26},"113157AB-0571-4244-A857-ADE4F4EA1F11","16.0.0","16.13.2",{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":177,"VersionStartExcluding":26,"VersionStartIncluding":178,"VersionEndExcluding":179,"VersionEndIncluding":26},"9DF5B801-BC99-4F91-B350-C14A5998532C","17.0.0","17.3.1",{"Operator":26,"Negate":26,"Nodes":181},[182],{"Operator":163,"Negate":26,"CPEMatch":183},[184,186,188,190,193,196,198,201,204,206,208],{"Vulnerable":4,"Criteria":51,"MatchCriteriaID":185,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"079F2588-2746-408B-9BB0-9A569289985B",{"Vulnerable":4,"Criteria":54,"MatchCriteriaID":187,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"51600424-E294-41E0-9C8B-12D0C3456027",{"Vulnerable":4,"Criteria":57,"MatchCriteriaID":189,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"C3D12B98-032F-49A6-B237-E0CAD32D9A25",{"Vulnerable":4,"Criteria":60,"MatchCriteriaID":191,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":192},"CDB1E9C2-30CD-4DD2-BB9F-AF59B8DA9B9E","8.0.29",{"Vulnerable":4,"Criteria":63,"MatchCriteriaID":194,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":195},"727AE4B8-ECED-4942-B378-AC869D39D8D0","8.0.28",{"Vulnerable":4,"Criteria":66,"MatchCriteriaID":197,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":192},"B0EBAC6D-D0CE-42A1-AEA0-2D50C8035747",{"Vulnerable":4,"Criteria":69,"MatchCriteriaID":199,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":200},"361CAD5F-8866-44CC-A47E-C0E98A9FAABA","5.7.37",{"Vulnerable":4,"Criteria":69,"MatchCriteriaID":202,"VersionStartExcluding":26,"VersionStartIncluding":203,"VersionEndExcluding":26,"VersionEndIncluding":195},"3D713546-8144-491B-B3D9-FBE437E4A442","8.0.0",{"Vulnerable":4,"Criteria":72,"MatchCriteriaID":205,"VersionStartExcluding":26,"VersionStartIncluding":203,"VersionEndExcluding":26,"VersionEndIncluding":195},"D1768074-FDA8-485C-B005-7FB3F7AA2330",{"Vulnerable":4,"Criteria":76,"MatchCriteriaID":207,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9",{"Vulnerable":4,"Criteria":79,"MatchCriteriaID":209,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"C8AF00C6-B97F-414D-A8DF-057E6BFD8597",{"Operator":26,"Negate":26,"Nodes":211},[212],{"Operator":163,"Negate":26,"CPEMatch":213},[214],{"Vulnerable":4,"Criteria":84,"MatchCriteriaID":215,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"FA6FEEC2-9F11-4643-8827-749718254FED",[],[218],{"id":219,"eventType":220,"eventTime":221,"details":222,"label":223,"color":224},"b47e98e6-8691-4a9c-b962-b018a61d0a94","HIGH_EPSS_DELTA","2026-06-16T04:05:32.846951+00:00","Daily EPSS score increased by 0.102 on 2023-12-30","EPSS Score Increased","red",{"lastModified":11,"cacheTime":226,"version":32},1792242256439,{"score":228,"band":40,"action":229,"scoredAt":230},44,"Plan remediation","2026-10-16T06:53:39.812312+00:00"]