Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-44533

CVE-2021-44533MEDIUM

NodeJS Node — Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  L  N    5.3   .0936   95.3     —

AFFECTED
  Product  Versions  Fixed
  Node     4.0 –     —

TIMELINE
  Dec 2   Reserved by hackerone
  Feb 24  Published (CNA: hackerone)
  Oct 8   ENRICHED — CVE-2021-44533 (NodeJS Node). Received CVSS 5.3 and CPE data from NVD.
  Oct 8   EXPLOIT PUBLISHED — CVE-2021-44533 (NodeJS Node). Public exploit reference added.

CWE-295 · CNA: hackerone · CVSS v3.1 · 6 references · NVD status: Modified

Description

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
December 2, 2021	Reserved	Reserved by hackerone
February 24, 2022	Published	Published (CNA: hackerone)
October 8, 2026	ENRICHED	ENRICHED — CVE-2021-44533 (NodeJS Node). Received CVSS 5.3 and CPE data from NVD.
October 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2021-44533 (NodeJS Node). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
NodeJS	Node	—	4.0	—

Weaknesses

CWE-295

References (6)

https://hackerone.com/reports/1429694 [Exploit, Mitigation, Third Party Advisory]
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ [Release Notes, Vendor Advisory]
https://security.netapp.com/advisory/ntap-20220325-0007/ [Third Party Advisory]
https://www.debian.org/security/2022/dsa-5170 [Third Party Advisory]
https://www.oracle.com/security-alerts/cpuapr2022.html [Patch, Third Party Advisory]
https://www.oracle.com/security-alerts/cpujul2022.html [Third Party Advisory]

Authoritative record: CVE-2021-44533 at cve.org

Vendors: nodejs

Weaknesses: CWE-295

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-44533 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.