CVE-2021-44533 Security feature bypass in Node

Q: Which versions are affected by CVE-2021-44533?

2 open source packages ship an affected version, including node and node-min. It affects 9 products.

Q: Is CVE-2021-44533 being exploited?

There is no known exploitation of CVE-2021-44533 in the wild and no public exploit code.

Q: How do I fix CVE-2021-44533?

Upgrade node to a fixed version for your release line: 12.22.9, 14.18.3, 16.13.2 or 17.3.1.

Medium 5.3 Published 24 Feb 2022 Updated 8 Oct 2026

Attackers can bypass certificate subject verification by crafting ambiguous Relative Distinguished Names, affecting Node.js users relying on TLS validation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-44533?

CVE-2021-44533 is a medium-severity vulnerability in Debian Debian Linux, published on 24 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Weakness: CWE-295

Which versions are affected by CVE-2021-44533?

2 open source packages ship an affected version, including node and node-min. It affects 9 products.

Package	Affected	Fixed in
`node` Bitnami	All versions	`12.22.9, 14.18.3, 16.13.2, 17.3.1`
`node-min` Bitnami	All versions	`12.22.9, 14.18.3, 16.13.2, 17.3.1`

Products include Debian Debian Linux, Nodejs Node.js, Oracle Graalvm, Oracle Mysql Cluster, Oracle Mysql Connectors, Oracle Mysql Enterprise Monitor and 3 more.

How do I fix CVE-2021-44533?

Upgrade node to a fixed version for your release line: 12.22.9, 14.18.3, 16.13.2 or 17.3.1.

Is CVE-2021-44533 being exploited?

There is no known exploitation of CVE-2021-44533 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2021-44533, AZL-8819, BIT-node-2021-44533, BIT-node-min-2021-44533, CLEANSTART-2026-BN69349, CLEANSTART-2026-IA73546 and 3 more.