CVE-2021-31597
Improper Certificate Validation in xmlhttprequest-ssl
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
- Record
CVE-2021-31597- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
- Record
CVE-2021-31597- Updated
- 2026-11-02
EUVDEUVD-2021-0980 No score
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
- Record
EUVD-2021-0980- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-72mh-269x-7mh5
Improper Certificate Validation in xmlhttprequest-ssl
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
- Record
GHSA-72mh-269x-7mh5- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVAZL-45213
CVE-2021-31597 affecting package js-jquery 3.5.0-4
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
- Record
AZL-45213- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-05
OSV
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
- Record
CVE-2021-31597- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-72mh-269x-7mh5
Improper Certificate Validation in xmlhttprequest-ssl
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
- Record
GHSA-72mh-269x-7mh5- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-31597
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
- Record
UBUNTU-CVE-2021-31597- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1772064638 No score
TuxCare security update for xmlhttprequest-ssl (2 CVEs)
TuxCare rebuilt xmlhttprequest-ssl to address 2 CVEs. Fixed in 1.5.5-tuxcare.1.
- Record
CLSA-2026-1772064638- Updated
- 2026-11-02
OSVCLSA-2026-1773188115 No score
TuxCare security update for xmlhttprequest-ssl (2 CVEs)
TuxCare rebuilt xmlhttprequest-ssl to address 2 CVEs. Fixed in 1.5.3-tuxcare.1.
- Record
CLSA-2026-1773188115- Updated
- 2026-11-02
OSVCLSA-2026-1785204344 No score
TuxCare security update for xmlhttprequest-ssl (1 CVE)
TuxCare rebuilt xmlhttprequest-ssl to address 1 CVE. Fixed in 1.5.1-tuxcare.1.
- Record
CLSA-2026-1785204344- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xmlhttprequest-sslnpm |
before 1.6.1 | 1.6.1 |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
xmlhttprequest-sslTuxCare:npm From an advisory covering 2 CVEs |
1.5.5-tuxcare.0 up to 1.5.5-tuxcare.1, plus listed versions 1.5.5 |
1.5.5-tuxcare.1 |
xmlhttprequest-sslTuxCare:npm From an advisory covering 2 CVEs |
1.5.3-tuxcare.0 up to 1.5.3-tuxcare.1, plus listed versions 1.5.3 |
1.5.3-tuxcare.1 |
xmlhttprequest-sslTuxCare:npm |
1.5.1-tuxcare.0 up to 1.5.1-tuxcare.1, plus listed versions 1.5.1 |
1.5.1-tuxcare.1 |
node-xmlhttprequest-sslUbuntu:18.04:LTS |
All versions, plus listed versions 1.6.0-1 |
None known |
node-xmlhttprequest-sslUbuntu:20.04:LTS |
All versions, plus listed versions 1.6.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-31597 is a critical vulnerability (CVSS 9.4) in Xmlhttprequest-ssl Project Xmlhttprequest-ssl, published April 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile. Fixed in xmlhttprequest-ssl 1.6.1.
References
people.kingsds.network/wesgarland/xmlhttprequest-ssl-vuln.txt
github.com/mjwwit/node-XMLHttpRequest/compare/v1.6.0...1.6.1
security.netapp.com/advisory/ntap-20210618-0004
nvd.nist.gov/vuln/detail/CVE-2021-31597
ubuntu.com/security/CVE-2021-31597
cve.org/CVERecord?id=CVE-2021-31597