Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

xmlhttprequest-ssl may let attackers execute code

CVE-2021-31597 · published 4 days ago
Summary

The xmlhttprequest-ssl library used in several Node.js projects can be tricked into running unwanted code. Update to the latest released versions of the mjwwit/xmlhttprequest-ssl, xmlhttprequest-ssl_project/xmlhttprequest-ssl, xmlhttprequest-ssl, or @rootio/xmlhttprequest-ssl packages as soon as possible to apply the fix.

What to do
  • Update mjwwit xmlhttprequest-ssl to version 1.6.1.
  • Update xmlhttprequest-ssl to version 1.5.5-aikido.2.
  • Update rootio @rootio/xmlhttprequest-ssl to version 1.5.5-root.io.2.
  • Update xmlhttprequest-ssl_project xmlhttprequest-ssl to version 1.6.1 or later.
Affected software
Ecosystem VendorProductAffected versions
npm mjwwit xmlhttprequest-ssl < 1.6.1
Fix: upgrade to 1.6.1
– xmlhttprequest-ssl_project xmlhttprequest-ssl < 1.6.1
cpe:2.3:a:xmlhttprequest-ssl_project:xmlhttprequest-ssl:*:*:*:*:*:node.js:*:*
Root:npm – xmlhttprequest-ssl < 1.5.5-aikido.2
Fix: upgrade to 1.5.5-aikido.2
Root:npm rootio @rootio/xmlhttprequest-ssl < 1.5.5-root.io.2
Fix: upgrade to 1.5.5-root.io.2
Original advisory text
CVE-2021-31597 in xmlhttprequest-ssl - Patched by Root
Root has patched CVE-2021-31597 in the xmlhttprequest-ssl package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published11 Nov 2026
Updated13 Nov 2026
First seen6 Mar 2026
Sources
GHSA-72mh-269x-7mh5 · GHSA
CVE-2021-31597 · NVD
ROOT-APP-NPM-CVE-2021-31597 · OSV
Track software like this
Free during beta