Description
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NodeJS | Node | 4.0 – < 4.*, 5.0 – < 5.*, 6.0 – < 6.*, 7.0 – < 7.*, 8.0 – < 8.*, 9.0 – < 9.*, 10.0 – < 10.*, 11.0 – < 11.*, 12.0 – < 12.22.9, 13.0 – < 13.*, 14.0 – < 14.18.3, 15.0 – < 15.*, 16.0 – < 16.13.2, 17.0 – < 17.3.1 | 4.* |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nodejs | 12.22.9~dfsg-1 | — |
| Debian 13 | nodejs | 12.22.9~dfsg-1 | — |
| Debian 12 | nodejs | 12.22.9~dfsg-1 | — |
| Debian 11 | nodejs | 12.22.12~dfsg-1~deb11u1 | DSA-5170-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | nodejs | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nodejs +3 | 1:12.22.12-1.module+el8.6.0+15324+1f2c5d8d | RHSA-2022:9073, RHSA-2022:7830, RHEA-2022:5139 |
| RHEL 8 | nodejs-nodemon | 2.0.3-1.module+el8.4.0+11732+c668cc9f | RHSA-2022:9073, RHSA-2022:7830, RHEA-2022:5139 |
| RHEL 8 | nodejs-packaging | 17-3.module+el8.1.0+3369+37ae6a45 | RHSA-2022:9073, RHSA-2022:7830, RHEA-2022:5139 |
| RHEL 8 | npm | 1:6.14.16-1.12.22.12.1.module+el8.6.0+15324+1f2c5d8d | RHSA-2022:9073, RHSA-2022:7830, RHEA-2022:5139 |
| RHEL 3 | rh-nodejs12-nodejs +2 | 12.22.12-2.el7 | RHSA-2022:4914 |
| RHEL 3 | rh-nodejs12-npm | 6.14.16-12.22.12.2.el7 | RHSA-2022:4914 |
| RHEL 3 | rh-nodejs14-nodejs +2 | 14.20.1-2.el7 | RHSA-2022:7044 |
| RHEL 3 | rh-nodejs14-npm | 6.14.17-14.20.1.2.el7 | RHSA-2022:7044 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.6 EUS | nodejs +3 | 1:14.21.3-1.module+el8.6.0+18532+cbe6f646 | RHSA-2023:1742 |
| RHEL 8.6 EUS | nodejs-nodemon | 2.0.20-3.module+el8.6.0+18532+cbe6f646 | RHSA-2023:1742 |
| RHEL 8.6 EUS | nodejs-packaging | 23-3.module+el8.3.0+6519+9f98ed83 | RHSA-2023:1742 |
| RHEL 8.6 EUS | npm | 1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646 | RHSA-2023:1742 |
| RHEL 8.4 EUS | nodejs +3 | 1:12.22.12-1.module+el8.4.0+15323+4d1cc445 | RHEA-2022:5615 |
| RHEL 8.4 EUS | nodejs-nodemon | 2.0.3-1.module+el8.4.0+11732+c668cc9f | RHEA-2022:5615 |
| RHEL 8.4 EUS | nodejs-packaging | 17-3.module+el8.1.0+3369+37ae6a45 | RHEA-2022:5615 |
| RHEL 8.4 EUS | npm | 1:6.14.16-1.12.22.12.1.module+el8.4.0+15323+4d1cc445 | RHEA-2022:5615 |
| RHEL 8.2 EUS | nodejs +3 | 1:12.22.12-1.module+el8.2.0+15322+a70ca0ab | RHEA-2022:5221 |
| RHEL 8.2 EUS | nodejs-nodemon | 1.18.3-1.module+el8.1.0+3369+37ae6a45 | RHEA-2022:5221 |
| RHEL 8.2 EUS | nodejs-packaging | 17-3.module+el8.1.0+3369+37ae6a45 | RHEA-2022:5221 |
| RHEL 8.2 EUS | npm | 1:6.14.16-1.12.22.12.1.module+el8.2.0+15322+a70ca0ab | RHEA-2022:5221 |
| RHEL 8.1 E4S | nodejs +3 | 1:12.22.12-1.module+el8.1.0+15296+87b2f6ad | RHEA-2022:4925 |
| RHEL 8.1 E4S | nodejs-nodemon | 1.18.3-1.module+el8.1.0+3369+37ae6a45 | RHEA-2022:4925 |
| RHEL 8.1 E4S | nodejs-packaging | 17-3.module+el8.1.0+3369+37ae6a45 | RHEA-2022:4925 |
| RHEL 8.1 E4S | npm | 1:6.14.16-1.12.22.12.1.module+el8.1.0+15296+87b2f6ad | RHEA-2022:4925 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nodejs +3 | 1:14.20.1-2.module_el8.7.0+3342+b2df8497 | ALSA-2022:9073, ALSA-2022:7830 |
| AlmaLinux 8 | nodejs-nodemon | 2.0.19-2.module_el8.6.0+3261+490666b3 | ALSA-2022:9073, ALSA-2022:7830 |
| AlmaLinux 8 | nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 | ALSA-2022:9073, ALSA-2022:7830 |
| AlmaLinux 8 | npm | 1:6.14.17-1.14.20.1.2.module_el8.7.0+3342+b2df8497 | ALSA-2022:9073, ALSA-2022:7830 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nodejs | 1:14.20.1-2.module+el8.7.0+1071+4bdda2a8 | RLSA-2022:9073, RLSA-2022:7830 |
| Rocky Linux 8 | nodejs-nodemon | 2.0.19-2.module+el8.6.0+1003+ae94235a | RLSA-2022:9073, RLSA-2022:7830 |
| Rocky Linux 8 | nodejs-packaging | 23-3.module+el8.3.0+100+234774f7 | RLSA-2022:9073, RLSA-2022:7830 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | nodejs12 | 12.22.9-4.25.1 | SUSE-SU-2022:0113-1 |
| SLES 15 SP3 | nodejs14 | 14.18.3-15.24.1 | SUSE-SU-2022:0112-1 |
| SLES 12 | nodejs12 | 12.22.9-1.38.1 | SUSE-SU-2022:0101-1 |
| SLES 12 | nodejs14 | 14.18.3-6.21.1 | SUSE-SU-2022:0114-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP3 | chromium | 100.0.4896.88-bp153.2.82.1 | openSUSE-SU-2022:0112-1 |
| SUSE Package Hub 15 SP3 | htmldoc | 1.9.12-bp153.2.9.1 | openSUSE-SU-2022:0113-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nodejs16 | 16.13.2-1.1 | openSUSE-SU-2024:11746-1 |
| openSUSE Tumbleweed | nodejs17 | 17.3.1-1.1 | openSUSE-SU-2024:11730-1 |
| openSUSE Leap 15.3 | chromium | 100.0.4896.88-bp153.2.82.1 | openSUSE-SU-2022:0112-1 |
| openSUSE Leap 15.3 | htmldoc | 1.9.12-bp153.2.9.1 | openSUSE-SU-2022:0113-1 |
| openSUSE Leap 15.3 | nodejs12 | 12.22.9-4.25.1 | openSUSE-SU-2022:0113-1 |
| openSUSE Leap 15.3 | nodejs14 | 14.18.3-15.24.1 | openSUSE-SU-2022:0112-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nodejs | 16.13.2-r0 | — |
| Alpine v3.24 | nodejs-current | 17.3.1-r0 | — |
| Alpine v3.24 | openjdk11 | 11.0.15_p10-r0 | — |
| Alpine v3.23 | nodejs | 16.13.2-r0 | — |
| Alpine v3.23 | nodejs-current | 17.3.1-r0 | — |
| Alpine v3.23 | openjdk11 | 11.0.15_p10-r0 | — |
| Alpine v3.22 | nodejs | 16.13.2-r0 | — |
| Alpine v3.22 | nodejs-current | 17.3.1-r0 | — |
| Alpine v3.22 | openjdk11 | 11.0.15_p10-r0 | — |
| Alpine v3.21 | nodejs | 16.13.2-r0 | — |
| Alpine v3.21 | nodejs-current | 17.3.1-r0 | — |
| Alpine v3.21 | openjdk11 | 11.0.15_p10-r0 | — |
| Alpine v3.20 | nodejs | 16.13.2-r0 | — |
| Alpine v3.20 | nodejs-current | 17.3.1-r0 | — |
| Alpine v3.20 | openjdk11 | 11.0.15_p10-r0 | — |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nodejs | 16.13.2-r0 | — |
| Alpine v3.19 | nodejs-current | 17.3.1-r0 | — |
| Alpine v3.19 | openjdk11 | 11.0.15_p10-r0 | — |
| Alpine v3.18 | nodejs | 16.13.2-r0 | — |
| Alpine v3.18 | nodejs-current | 17.3.1-r0 | — |
| Alpine v3.18 | openjdk11 | 11.0.15_p10-r0 | — |
| Alpine v3.17 | nodejs | 16.13.2-r0 | — |
| Alpine v3.17 | nodejs-current | 17.3.1-r0 | — |
| Alpine v3.17 | openjdk11 | 11.0.15_p10-r0 | — |
| Alpine v3.16 | nodejs | 16.13.2-r0 | — |
| Alpine v3.16 | nodejs-current | 17.3.1-r0 | — |
| Alpine v3.16 | openjdk11 | 11.0.15_p10-r0 | — |
| Alpine v3.15 | nodejs | 16.13.2-r0 | — |
| Alpine v3.15 | nodejs-current | 17.3.1-r0 | — |
| Alpine v3.15 | openjdk11 | 11.0.15_p10-r0 | — |
| Alpine v3.14 | nodejs | 14.19.0-r0 | — |
| Alpine v3.13 | nodejs | 14.19.0-r0 | — |
| Alpine v3.12 | nodejs | 12.22.10-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs +4 | 1:18.12.1-1.amzn2023.0.2 | ALAS2023-2023-084 |
| Amazon Linux 2023 | npm | 1:8.19.2-1.18.12.1.1.amzn2023.0.2 | ALAS2023-2023-084 |
| Amazon Linux 2023 | v8-devel | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.2 | ALAS2023-2023-084 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | nodejs | 16.14.0-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nodejs +3 | 1:14.20.1-2.module+el8.6.0+20874+338992dc | ELSA-2022-7830 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.19-2.module+el8.6.0+20729+8fb6d84e | ELSA-2022-7830 |
| Oracle Linux 8 | nodejs-packaging | 23-3.module+el8.3.0+7818+6cd30d85 | ELSA-2022-7830 |
| Oracle Linux 8 | npm | 1:6.14.17-1.14.20.1.2.module+el8.6.0+20874+338992dc | ELSA-2022-7830 |
Advisories 31
- ALSA-2022:9073 Moderate: nodejs:16 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:7830 Moderate: nodejs:14 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:1742 Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2022:4914 Red Hat Security Advisory: rh-nodejs12-nodejs security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHEA-2022:5615 Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHEA-2022:5139 Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHEA-2022:5221 Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHEA-2022:4925 Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2022:9073 Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:7044 Red Hat Security Advisory: rh-nodejs14-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2022-0432 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2022-0302 Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2022:7830 Red Hat Security Advisory: nodejs:14 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-5170-1 nodejs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:7830 Moderate: nodejs:14 security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2022:9073 Moderate: nodejs:16 security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:0112-1 Security update for nodejs14 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11746-1 corepack16-16.13.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0114-1 Security update for nodejs14 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0101-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11730-1 corepack17-17.3.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0113-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0113-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- FSA-202302 Festo: Several vulnerabilities in FactoryViews CERT@VDE · Feb 2, 2026
- WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2025-2471 IBM Spectrum Protect Plus: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025
- WID-SEC-2022-0099 Node.js: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- openSUSE-SU-2022:0112-1 Security update for nodejs14 SUSE / openSUSE Security Updates · May 7, 2025
- ALAS2023-2023-084 Important: nodejs security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ELSA-2022-7830 Moderate: nodejs:14 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 15, 2022