CVE-2021-31597 Improper Certificate Validation in xmlhttprequest-ssl
The xmlhttprequest-ssl library disables SSL certificate validation by default, allowing attackers to bypass security checks and intercept encrypted traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-31597?
CVE-2021-31597 is a critical vulnerability in n/a, published on 22 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Weakness: CWE-295
Which versions are affected by CVE-2021-31597?
2 open source packages ship an affected version, including xmlhttprequest-ssl. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
xmlhttprequest-ssl npm | All versions | 1.6.1 |
xmlhttprequest-ssl npm | All versions | 1.6.1 |
Products include Xmlhttprequest-Ssl Project Xmlhttprequest-Ssl.
How do I fix CVE-2021-31597?
Upgrade xmlhttprequest-ssl to 1.6.1 or later.
Is CVE-2021-31597 being exploited?
There is no known exploitation of CVE-2021-31597 in the wild and no public exploit code.
Sources
Also known as AZL-45213, CLSA-2026-1785204344, GHSA-72mh-269x-7mh5, UBUNTU-CVE-2021-31597.