# HTTPS certificate non-validation vulnerability in Node.js

DevFeed: [HTTPS certificate non-validation vulnerability in Node.js](<https://devfeed.tech/articles/https-certificate-non-validation-vulnerability-in-node-js-19087.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/node-https-vulnerability/>)

Author: HTTP Toolkit; Tim Perry

Published: 2021-08-11T17:00:00Z

Content type: article

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [Node.js](<https://devfeed.tech/topics/node-js.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [Security](<https://devfeed.tech/topics/security.md>), [TypeScript](<https://devfeed.tech/topics/typescript.md>)

Tags: [certificates](<https://devfeed.tech/tags/certificates.md>), [cve](<https://devfeed.tech/tags/cve.md>), [http](<https://devfeed.tech/tags/http.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>), [tls](<https://devfeed.tech/tags/tls.md>), [typescript](<https://devfeed.tech/tags/typescript.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This article examines CVE-2021-22939, a Node.js vulnerability in which falsey values passed to the HTTPS `rejectUnauthorized` option could disable TLS certificate verification. It explains the security risk, shows vulnerable TypeScript code, and recommends updating affected Node.js versions.

## Source excerpt

Today Node.js announced and released a security fix for CVE-2021-22939, along with two other high severity issues. They've rated this vulnerability as 'low severity', but I think it's worth a closer look, as (imo) this really understates the risk here, and the potentially widespread impact. In practice, this poses a risk to anybody making TLS connections from Node.js, e.g. anybody making HTTPS requests. Not all usage is vulnerable, but many common use cases are, it's not easy to guarantee that your code is 100% secure, and all Node.js versions since at least v8.0.0 are affected. If you're using TLS/HTTPS in Node.js, you should update ASAP. I reported this issue to Node myself a couple of weeks ago, after running into it during my own development testing HTTP Toolkit. Let's talk through why this is a problem, how it works, and what you should do about it. Everything here applies to TLS in general, but I'm going to focus on HTTPS specifically, since it's by far the most likely use case, and it's simpler and clearer. What's the problem? Here's an example of common but vulnerable code (TypeScript types included for clarity): const https = require('https'); // Any convenient wrapper or library around the HTTPS module. It takes a URL, and // extra optional parameters, including a `verifyCertificates` option, which can // be set to `false` to disable cert verification when necessary. function makeRequest(url: string, options: { verifyCertificates?: boolean } = {}) { // [...Do some custom logic...] // At some point make a request, using the optional verification option: return https.get(url, { rejectUnauthorized: options.verifyCertificates }); } // Later usage looks like it's making a secure HTTPS request, but in fact the certificate // is not being verified at all, so you could be talking to *anybody*: makeRequest("https://google.com"); The key here is rejectUnauthorized. This Node.js option configures whether the request will check that the server's certificate is valid.