← Back

CVE-2021-31597

nvd nist
Published: Apr 23, 2021Modified: Jun 17, 2026

JSON object

Loading...
9.4
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Exploitability: 3.9 / Impact: 5.5
Source: NVD

Description

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.

Affected (1)

Xmlhttprequest Ssl Project
1 product
Xmlhttprequest Ssl
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Xmlhttprequest Ssl
Before 1.6.1

Related CWEs

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.

References (8)

Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchRelease NotesThird Party Advisory
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchRelease NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.