VULNERABILITY INTELLIGENCE

CVE-2021-22939

CVSS score5.3 MEDIUM

EPSS probability14.73%

CISA KEVNot currently listed

Published2021-08-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

Weakness classification

support@hackerone.com: CWE-295
nvd@nist.gov: CWE-295

Primary references

support@hackerone.com — Patch, Third Party Advisory
support@hackerone.com — Exploit, Issue Tracking, Third Party Advisory
support@hackerone.com — Issue Tracking, Third Party Advisory
support@hackerone.com — Patch, Vendor Advisory
support@hackerone.com
support@hackerone.com — Third Party Advisory
support@hackerone.com — Patch, Third Party Advisory
support@hackerone.com — Patch, Third Party Advisory
support@hackerone.com — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory