CVE-2021-22939: debian debian_linux Improper Certificate Validation

Modified

AliasesALPINE-CVE-2021-22939UBUNTU-CVE-2021-22939DEBIAN-CVE-2021-22939

Published 16-08-2021Last modified 30-04-2025

Vulnerability summary

CVE-2021-22939 is a medium (CVSS 5.3) Improper Certificate Validation vulnerability in debian debian_linux. EPSS estimates a 14.73% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (NVD)

EPSS score

14.73%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Timeline

16-08-2021
PublishedVulnerability first disclosed.
30-04-2025
Last modifiedVulnerability information updated.

Description

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.15.3v2.05.0

EPSS trend

Probability

14.73%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 14.73% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (hackerone.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Oracle4 products

graalvmEOL20.3.3 | 21.2.0
jd_edwards_enterpriseone_tools≤ 9.2.6.1
mysql_cluster≤ 8.0.26
peoplesoft_enterprise_peopletools8.57 | 8.58 | 8.59

Alpine2 products

nodejs< 12.22.5-r0 | < 14.17.5-r0
nodejs-current< 16.11.1-r0 | < 16.6.2-r0

Debian2 products

nodejs< 12.22.5~dfsg-1
debian_linuxEOL10.0

Nodejs2 products

node≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.22.5 | ≥ 13.0, < 13.* | ≥ 14.0, < 14.17.5 | ≥ 15.0, < 15.* | ≥ 16.0, < 16.6.2
node.js≥ 12.0.0, < 12.22.5 | ≥ 14.0.0, < 14.17.5 | ≥ 16.0.0, < 16.6.2

Netapp1 product