CVE-2021-22939
No sign of exploitation. No public exploitation artifact known so far.
Node.js failed to validate an incorrectly configured HTTPS setting, allowing connections to servers with expired SSL certificates when the rejectUnauthorized parameter was set to undefined. This creates a security risk because expired certificates should be rejected to prevent man-in-the-middle attacks.
When the rejectUnauthorized parameter in the Node.js https API was set to undefined instead of an explicit boolean value, certificate validation was silently disabled. An attacker controlling a server with an expired certificate could intercept HTTPS connections if the application relied on this misconfiguration, as the validation error was not raised and the connection was accepted.