{"id":"CVE-2021-31597","aliases":["AZL-45213","CLSA-2026-1772064638","CLSA-2026-1773188115","CLSA-2026-1785204344","EUVD-2021-0980","GHSA-72mh-269x-7mh5","UBUNTU-CVE-2021-31597"],"status":"published","title":"Improper Certificate Validation in xmlhttprequest-ssl","description":"The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.","severity":{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02039,"percentile":0.81377,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2021-04-22T23:52:48Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"xmlhttprequest-ssl","fixed_in":["1.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"xmlhttprequest-ssl","fixed_in":["1.5.1-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.5-tuxcare.0"},{"fixed":"1.5.5-tuxcare.1"}]}],"versions":["1.5.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.3-tuxcare.0"},{"fixed":"1.5.3-tuxcare.1"}]}],"versions":["1.5.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.1-tuxcare.0"},{"fixed":"1.5.1-tuxcare.1"}]}],"versions":["1.5.1"]},{"source":"osv","ecosystem":"npm","package":"xmlhttprequest-ssl","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-xmlhttprequest-ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1"]}],"products":[{"vendor":"xmlhttprequest-ssl_project","product":"xmlhttprequest-ssl"}],"references":[{"url":"https://people.kingsds.network/wesgarland/xmlhttprequest-ssl-vuln.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/mjwwit/node-XMLHttpRequest/compare/v1.6.0...1.6.1","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/mjwwit/node-XMLHttpRequest/commit/bf53329b61ca6afc5d28f6b8d2dc2e3ca740a9b2","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20210618-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31597","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-72mh-269x-7mh5"},{"url":"https://security.netapp.com/advisory/ntap-20210618-0004","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-31597","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31597","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-31597","description":"The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.","status":"published","published":"2021-04-22T23:52:48Z","modified":"2024-08-03T23:03:33.466Z","updated_at":"2026-11-02T14:33:05.331617Z"}],"euvd":[{"id":"EUVD-2021-0980","description":"The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.","status":"published","published":"2021-04-22T23:52:48Z","modified":"2024-08-03T23:03:33Z","updated_at":"2026-11-03T03:24:38.977347Z"}],"ghsa":[{"id":"GHSA-72mh-269x-7mh5","title":"Improper Certificate Validation in xmlhttprequest-ssl","description":"The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.","status":"published","published":"2021-05-24T19:52:55Z","modified":"2023-11-29T22:43:23Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2021-31597","description":"The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.","status":"published","published":"2021-04-23T00:15:08.283Z","modified":"2026-06-17T03:52:03.017Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:52.03307Z"}],"osv":[{"id":"AZL-45213","title":"CVE-2021-31597 affecting package js-jquery 3.5.0-4","description":"The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.","status":"published","published":"2021-04-23T00:15:08Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2021-31597","description":"The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.","status":"published","published":"2021-04-23T00:15:08.283Z","modified":"2026-10-20T10:54:40.559060831Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"GHSA-72mh-269x-7mh5","title":"Improper Certificate Validation in xmlhttprequest-ssl","description":"The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.","status":"published","published":"2021-05-24T19:52:55Z","modified":"2023-11-08T04:05:49.810123Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"UBUNTU-CVE-2021-31597","description":"The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.","status":"published","published":"2021-04-23T00:15:00Z","modified":"2025-10-24T04:50:18Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"CLSA-2026-1772064638","title":"TuxCare security update for xmlhttprequest-ssl (2 CVEs)","description":"TuxCare rebuilt xmlhttprequest-ssl to address 2 CVEs. Fixed in 1.5.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:47:46.370500027Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773188115","title":"TuxCare security update for xmlhttprequest-ssl (2 CVEs)","description":"TuxCare rebuilt xmlhttprequest-ssl to address 2 CVEs. Fixed in 1.5.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.649409399Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1785204344","title":"TuxCare security update for xmlhttprequest-ssl (1 CVE)","description":"TuxCare rebuilt xmlhttprequest-ssl to address 1 CVE. Fixed in 1.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T19:13:11.32626256Z","updated_at":"2026-11-02T15:43:46.482572Z"}]}}