CVE-2021-22939 - CVE House

Status published Medium CVE-2021-22939

If the Node.js https API was used incorrectly and "undefined"...

5.3 CVSS

Vulnerability Description

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-22939

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from NodeJS

View All →

CVE-2025-23085

A memory leak could occur when a remote peer abruptly...

Medium 5.3

CVE-2025-23084

A vulnerability has been identified in Node.js, specifically affecting the...

Medium 5.6

CVE-2025-23083

With the aid of the diagnostics_channel utility, an event can...

High 7.7

CVE-2024-37372

The Permission Model assumes that any path starting with two...

Low 3.6

CVE-2024-36138

Bypass incomplete fix of CVE-2024-27980, that arises from improper handling...

High 8.1

Affected Vendor

NodeJS

View all reports →

Affected Software

Node

Vulnerable Versions:

4.0, 5.0, 6.0, 7.0, 8.0, 9.0, 10.0, 11.0, 12.0, 13.0, 14.0, 15.0, 16.0

Timeline

Official Publish: August 16th, 2021

Last Modified: April 30th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-295

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle

Credential Access

T1040 Network Sniffing

Collection

T1552 Unsecured Credentials