CVE-2021-22939

Node.js failed to validate an incorrectly configured HTTPS setting, allowing connections to servers with expired SSL certificates when the rejectUnauthorized parameter was set to undefined. This creates a security risk because expired certificates should be rejected to prevent man-in-the-middle attacks.

When the rejectUnauthorized parameter in the Node.js https API was set to undefined instead of an explicit boolean value, certificate validation was silently disabled. An attacker controlling a server with an expired certificate could intercept HTTPS connections if the application relied on this misconfiguration, as the validation error was not raised and the connection was accepted.