CVE-2021-39171 - CVE House
Back to Database
Status published Medium CVE-2021-39171

Unlimited transforms allowed for signed nodes

Vulnerability Description

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack. This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-39171

Credits & Attribution

No credits recorded in the NVD database.

References

More from node-saml

View All →
CVE-2025-54419
Node-SAML Contains SAML Signature Verification Vulnerability
Critical 10
CVE-2025-54369
Node-SAML SAML Authentication Bypass
Critical 9.3
CVE-2025-29775
xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
Critical 9.3
CVE-2025-29774
xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References
Critical 9.3
CVE-2024-32962
XML signature verification bypass due improper verification of signature / signature spoofing
Critical 10

Affected Vendor

Affected Software

passport-saml
Vulnerable Versions:
< 3.1.0

Timeline

Official Publish: August 27th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact