CVE-2020-8172: nodejs node.js Improper Certificate Validation
Vulnerability summary
CVE-2020-8172 is a high (CVSS 7.4) Improper Certificate Validation vulnerability in nodejs node.js. EPSS estimates a 6.07% chance of exploitation in the next 30 days, higher than 93.3% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 2Timeline
- 08-06-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
6.07%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
No change 0.00 pp
From 6.07% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle4 products
- banking_extensibility_workbench14.3.0 | 14.4.0
- blockchain_platform< 21.1.2
- graalvmEOL19.3.2 | 20.1.0
- mysql_cluster≤ 7.3.30 | ≥ 7.4.0, ≤ 7.4.29 | ≥ 7.5.0, ≤ 7.5.19 | ≥ 7.6.0, ≤ 7.6.15 | ≥ 8.0.0, ≤ 8.0.21
Alpine2 products
- nodejs< 12.20.1-r0 | < 12.18.3-r0 | < 12.18.0-r0
- nodejs-current< 14.4.0-r0
Nodejs1 product
- node.js≥ 12.0.0, < 12.18.0 | ≥ 14.0.0, < 14.4.0
Ubuntu1 product
- nodejs< 12.22.9~dfsg-1ubuntu3
4 vendors · 8 products