← Vulnerability feed

Vulnerability record · CVE-2020-8172 · published 8 June 2020

CVE-2020-8172: Nodejs node.js improper certificate validation vulnerability

Nodejs · Node.Js

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

7.4 CVSS 3.1 High EPSS 6.1% · top 6.9% CWE-295 · Improper certificate validation
7.4CVSS 3.1 base score, v2 5.8
6.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
5Affected product versions listed by NVD
18References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://hackerone.com/reports/811502 ExploitThird Party Advisory
https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/ Vendor Advisory
https://security.gentoo.org/glsa/202101-07 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200625-0002/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Not ApplicableThird Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html PatchThird Party Advisory
https://hackerone.com/reports/811502 ExploitThird Party Advisory
https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/ Vendor Advisory
https://security.gentoo.org/glsa/202101-07 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200625-0002/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Not ApplicableThird Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html PatchThird Party Advisory

Track CVE-2020-8172 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-41993Apple WebKit improper check allows arbitrary code executionCVE-2023-41993 is a WebKit flaw where processing web content can lead to arbitrary code execution, addressed with improved checks. Apple states it is…KEVEPSS 24%analysed7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed6.1CVE-2020-11023jQuery DOM manipulation methods XSS via untrusted HTML option elementsjQuery versions 1.0.3 through before 3.5.0 execute untrusted code when HTML containing <option> elements from untrusted sources is passed to DOM mani…KEVEPSS 85%analysed10.0CVE-2026-21636Nodejs node.js improper access control vulnerabilityA flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even …EPSS 0.88%10.0CVE-2015-0278Fedoraproject fedora vulnerabilitylibuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.EPSS 3.2%9.8CVE-2026-48930Nodejs node.js improper access control vulnerabilityA flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolve…EPSS 0.34%9.8CVE-2024-3566Haskell process library command injection vulnerabilityA command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess fu…EPSS 6.9%9.8CVE-2024-21896Nodejs node.js vulnerabilityThe permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be tr…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2020-8172), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.