Every CVE Search/ Get API key

CVE-2022-31183

mTLS client verification is skipped in fs2 on Node.js

9.1 CriticalFix available

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on Node.js. The JVM TLS implementation is completely independent. 2. TLSSockets in server-mode. Client-mode TLSSockets are implemented via a different API. 3. mTLS as enabled via requestCert = true in TLSParameters. The default setting is false for server-mode TLSSockets. It was introduced with the initial Node.js implementation of fs2-io in 3.1.0. A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised. If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.83%Down 0.1 points since Aug 2, 2022
90%50%10%1%

What each source reports

CVE List Score used 9.1

mTLS client verification is skipped in fs2 on Node.js

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on Node.js. The JVM TLS implementation is completely independent. 2. TLSSockets in server-mode. Client-mode TLSSockets are implemented via a different API. 3. mTLS as enabled via requestCert = true in TLSParameters. The default setting is false for server-mode TLSSockets. It was introduced with the initial Node.js implementation of fs2-io in 3.1.0. A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised. If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.

Record
CVE-2022-31183
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2022-6207 9.1

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on Node.js. The JVM TLS implementation is completely independent. 2. TLSSockets in server-mode. Client-mode TLSSockets are implemented via a different API. 3. mTLS as enabled via requestCert = true in TLSParameters. The default setting is false for server-mode TLSSockets. It was introduced with the initial Node.js implementation of fs2-io in 3.1.0. A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised. If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.

Record
EUVD-2022-6207
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-2cpx-6pqp-wf35 9.8

fs2-io skips mTLS client verification

Impact

When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds.

The vulnerability is limited to:

  1. fs2-io running on Node.js. The JVM TLS implementation is completely independent.
  2. TLSSockets in server-mode. Client-mode TLSSockets are implemented via a different API.
  3. mTLS as enabled via requestCert = true in TLSParameters. The default setting is false for server-mode TLSSockets.

It was introduced with the initial Node.js implementation of fs2-io in v3.1.0.

Patches

A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised.

Workarounds

If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-2cpx-6pqp-wf35
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-295
Updated
2026-11-02
NVD 9.1

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on Node.js. The JVM TLS implementation is completely independent. 2. TLSSockets in server-mode. Client-mode TLSSockets are implemented via a different API. 3. mTLS as enabled via requestCert = true in TLSParameters. The default setting is false for server-mode TLSSockets. It was introduced with the initial Node.js implementation of fs2-io in 3.1.0. A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised. If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.

Record
CVE-2022-31183
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-295
Updated
2026-11-02
OSV 9.1

mTLS client verification is skipped in fs2 on Node.js

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on Node.js. The JVM TLS implementation is completely independent. 2. TLSSockets in server-mode. Client-mode TLSSockets are implemented via a different API. 3. mTLS as enabled via requestCert = true in TLSParameters. The default setting is false for server-mode TLSSockets. It was introduced with the initial Node.js implementation of fs2-io in 3.1.0. A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised. If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.

Record
CVE-2022-31183
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVGHSA-2cpx-6pqp-wf35 9.8

fs2-io skips mTLS client verification

Impact

When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds.

The vulnerability is limited to:

  1. fs2-io running on Node.js. The JVM TLS implementation is completely independent.
  2. TLSSockets in server-mode. Client-mode TLSSockets are implemented via a different API.
  3. mTLS as enabled via requestCert = true in TLSParameters. The default setting is false for server-mode TLSSockets.

It was introduced with the initial Node.js implementation of fs2-io in v3.1.0.

Patches

A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised.

Workarounds

If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-2cpx-6pqp-wf35
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-295
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
co.fs2:fs2-io
Maven
 3.1.0 up to 3.2.11
3.2.11
co.fs2:fs2-io_2.12
Maven
 3.1.0 up to 3.2.11
3.2.11
co.fs2:fs2-io_3
Maven
 3.1.0 up to 3.2.11
3.2.11
co.fs2:fs2-io_2.13
Maven
 3.1.0 up to 3.2.11
3.2.11
co.fs2:fs2-io_sjs1_2.13
Maven
 3.1.0 up to 3.2.11
3.2.11
co.fs2:fs2-io_sjs1_3
Maven
 3.1.0 up to 3.2.11
3.2.11
co.fs2:fs2-io_2.12
Maven
 3.1.0 up to 3.2.11, plus listed versions
3.1-10-500b3663.1-10-abf6bb03.1-10-f3d23ce3.1-11-28617f63.1-11-d8073c7
Show 45 moreShow less
3.1-12-4362ce33.1-12-ae5aa013.1-13-e59977f3.1-14-125a0193.1-14-20a3d6b3.1-16-d98156e3.1-17-eb39fe43.1-18-a2a47403.1-19-c0178583.1-19-c9457433.1-2-0716b7f3.1-2-0c2a32b3.1-2-47f04f63.1-2-73a4eb73.1-2-8dabe123.1-20-eaba3663.1-22-d0b358c3.1-23-8ba9dc53.1-24-92c750d3.1-26-1d4f2503.1-26-5d4436a3.1-26-b6790a03.1-27-dafd5773.1-29-da7a21c3.1-30-d9bcdf63.1-31-67ff9013.1-32-4f6e5c33.1-33-506d2733.1-36-a2c51353.1-37-271f8b83.1-37-6fe2fd63.1-4-47854083.1-4-6163cc43.1-4-7cff3833.1-4-cad30d23.1-42-91938ac3.1-46-1de1e8b3.1-46-f537af03.1-48-18e0eb93.1-48-7f7e1653.1-50-a7749f13.1-52-0f20c993.1-52-2ac85a23.1-52-5c8346c3.1-52-780511a
3.2.11
co.fs2:fs2-io_3
Maven
 3.1.0 up to 3.2.11, plus listed versions
3.1-10-500b3663.1-10-abf6bb03.1-10-f3d23ce3.1-11-28617f63.1-11-d8073c7
Show 45 moreShow less
3.1-12-4362ce33.1-12-ae5aa013.1-13-e59977f3.1-14-125a0193.1-14-20a3d6b3.1-16-d98156e3.1-17-eb39fe43.1-18-a2a47403.1-19-c0178583.1-19-c9457433.1-2-0716b7f3.1-2-0c2a32b3.1-2-47f04f63.1-2-73a4eb73.1-2-8dabe123.1-20-eaba3663.1-22-d0b358c3.1-23-8ba9dc53.1-24-92c750d3.1-26-1d4f2503.1-26-5d4436a3.1-26-b6790a03.1-27-dafd5773.1-29-da7a21c3.1-30-d9bcdf63.1-31-67ff9013.1-32-4f6e5c33.1-33-506d2733.1-36-a2c51353.1-37-271f8b83.1-37-6fe2fd63.1-4-47854083.1-4-6163cc43.1-4-7cff3833.1-4-cad30d23.1-42-91938ac3.1-46-1de1e8b3.1-46-f537af03.1-48-18e0eb93.1-48-7f7e1653.1-50-a7749f13.1-52-0f20c993.1-52-2ac85a23.1-52-5c8346c3.1-52-780511a
3.2.11
co.fs2:fs2-io_2.13
Maven
 3.1.0 up to 3.2.11, plus listed versions
3.1-10-500b3663.1-10-abf6bb03.1-10-f3d23ce3.1-11-28617f63.1-11-d8073c7
Show 45 moreShow less
3.1-12-4362ce33.1-12-ae5aa013.1-13-e59977f3.1-14-125a0193.1-14-20a3d6b3.1-16-d98156e3.1-17-eb39fe43.1-18-a2a47403.1-19-c0178583.1-19-c9457433.1-2-0716b7f3.1-2-0c2a32b3.1-2-47f04f63.1-2-73a4eb73.1-2-8dabe123.1-20-eaba3663.1-22-d0b358c3.1-23-8ba9dc53.1-24-92c750d3.1-26-1d4f2503.1-26-5d4436a3.1-26-b6790a03.1-27-dafd5773.1-29-da7a21c3.1-30-d9bcdf63.1-31-67ff9013.1-32-4f6e5c33.1-33-506d2733.1-36-a2c51353.1-37-271f8b83.1-37-6fe2fd63.1-4-47854083.1-4-6163cc43.1-4-7cff3833.1-4-cad30d23.1-42-91938ac3.1-46-1de1e8b3.1-46-f537af03.1-48-18e0eb93.1-48-7f7e1653.1-50-a7749f13.1-52-0f20c993.1-52-2ac85a23.1-52-5c8346c3.1-52-780511a
3.2.11
co.fs2:fs2-io_sjs1_2.13
Maven
 3.1.0 up to 3.2.11, plus listed versions
3.1-10-500b3663.1-10-abf6bb03.1-10-f3d23ce3.1-11-28617f63.1-11-d8073c7
Show 45 moreShow less
3.1-12-4362ce33.1-12-ae5aa013.1-13-e59977f3.1-14-125a0193.1-14-20a3d6b3.1-16-d98156e3.1-17-eb39fe43.1-18-a2a47403.1-19-c0178583.1-19-c9457433.1-2-0716b7f3.1-2-0c2a32b3.1-2-47f04f63.1-2-73a4eb73.1-2-8dabe123.1-20-eaba3663.1-22-d0b358c3.1-23-8ba9dc53.1-24-92c750d3.1-26-1d4f2503.1-26-5d4436a3.1-26-b6790a03.1-27-dafd5773.1-29-da7a21c3.1-30-d9bcdf63.1-31-67ff9013.1-32-4f6e5c33.1-33-506d2733.1-36-a2c51353.1-37-271f8b83.1-37-6fe2fd63.1-4-47854083.1-4-6163cc43.1-4-7cff3833.1-4-cad30d23.1-42-91938ac3.1-46-1de1e8b3.1-46-f537af03.1-48-18e0eb93.1-48-7f7e1653.1-50-a7749f13.1-52-0f20c993.1-52-2ac85a23.1-52-5c8346c3.1-52-780511a
3.2.11
co.fs2:fs2-io_sjs1_3
Maven
 3.1.0 up to 3.2.11, plus listed versions
3.1-10-500b3663.1-10-abf6bb03.1-10-f3d23ce3.1-11-28617f63.1-11-d8073c7
Show 45 moreShow less
3.1-12-4362ce33.1-12-ae5aa013.1-13-e59977f3.1-14-125a0193.1-14-20a3d6b3.1-16-d98156e3.1-17-eb39fe43.1-18-a2a47403.1-19-c0178583.1-19-c9457433.1-2-0716b7f3.1-2-0c2a32b3.1-2-47f04f63.1-2-73a4eb73.1-2-8dabe123.1-20-eaba3663.1-22-d0b358c3.1-23-8ba9dc53.1-24-92c750d3.1-26-1d4f2503.1-26-5d4436a3.1-26-b6790a03.1-27-dafd5773.1-29-da7a21c3.1-30-d9bcdf63.1-31-67ff9013.1-32-4f6e5c33.1-33-506d2733.1-36-a2c51353.1-37-271f8b83.1-37-6fe2fd63.1-4-47854083.1-4-6163cc43.1-4-7cff3833.1-4-cad30d23.1-42-91938ac3.1-46-1de1e8b3.1-46-f537af03.1-48-18e0eb93.1-48-7f7e1653.1-50-a7749f13.1-52-0f20c993.1-52-2ac85a23.1-52-5c8346c3.1-52-780511a
3.2.11

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31183 is a critical vulnerability (CVSS 9.1) in Typelevel Fs2, published July 29, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in co.fs2:fs2-io 3.2.11.

References

This page doesn't list everything

Left out here: 480 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open