CVE-2021-31597

PoC —

CVSS 3.1

9.4 critical

EPSS

2%p80

Published

Apr 23, 2021 (Apr 23, 2021)

Modified

Jun 17, 2026

Description

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.

Vendors: xmlhttprequest-ssl project
Products: xmlhttprequest-ssl
Weakness: CWE-295
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

NVD CVE.org GitHub PoCs EPSS (2.1%)

In the news0 stories

No ingested article mentions this CVE yet.