CVE-2021-44533: debian debian_linux Improper Certificate Validation
Vulnerability summary
CVE-2021-44533 is a medium (CVSS 5.3) Improper Certificate Validation vulnerability in debian debian_linux. EPSS estimates a 9.36% chance of exploitation in the next 30 days, higher than 95.3% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 19 · Related 8Timeline
- 24-02-2022PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
9.36%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
No change 0.00 pp
From 9.36% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle7 products
- graalvmEOL20.3.5 | 21.3.1 | 22.0.0.2
- mysql_cluster< 8.0.29 | 8.0.29
- mysql_connectors≤ 8.0.28
- mysql_enterprise_monitor≤ 8.0.29
- mysql_server≤ 5.7.37 | ≥ 8.0.0, ≤ 8.0.28
Alpine3 products
- nodejs< 12.22.10-r0 | < 14.19.0-r0 | < 16.13.2-r0
- nodejs-current< 17.3.1-r0
- openjdk11< 11.0.15_p10-r0
Debian2 products
- nodejs< 12.22.9~dfsg-1
- debian_linuxEOL11.0
Nodejs2 products
- node≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.22.9 | ≥ 13.0, < 13.* | ≥ 14.0, < 14.18.3 | ≥ 15.0, < 15.* | ≥ 16.0, < 16.13.2 | ≥ 17.0, < 17.3.1
- node.js< 12.22.9 | ≥ 14.0.0, < 14.18.3 | ≥ 16.0.0, < 16.13.2 | ≥ 17.0.0, < 17.3.1
Ubuntu1 product
- nodejsAll versions (No fix recorded)
5 vendors · 15 products
References
13 links- nodejs.org/en/blog/vulnerability/jan-2022-security-releases/X Refsource MISCRelease NotesVendor Advisory
