Skip to content
Fencer Vulns
critical 9.1

CVE-2022-31183 json

mTLS client verification is skipped in fs2 on Node.js

published 2022-07-29 4 y ago modified 2026-06-17 4 mo ago also GHSA-2cpx-6pqp-wf35 , EUVD-2022-6207

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. `fs2-io` running on Node.js. The JVM TLS implementation is completely independent. 2. `TLSSocket`s in server-mode. Client-mode `TLSSocket`s are implemented via a different API. 3. mTLS as enabled via `requestCert = true` in `TLSParameters`. The default setting is `false` for server-mode `TLSSocket`s. It was introduced with the initial Node.js implementation of fs2-io in 3.1.0. A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised. If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.

Patch / fix

  • maven co.fs2:fs2-io 3.2.11
  • maven co.fs2:fs2-io_2.12 3.2.11
  • maven co.fs2:fs2-io_3 3.2.11
  • maven co.fs2:fs2-io_2.13 3.2.11
  • maven co.fs2:fs2-io_sjs1_2.13 3.2.11
  • maven co.fs2:fs2-io_sjs1_3 3.2.11
  • typelevel fs2 3.2.11

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
18 mo ago

Exploit prediction

0.83% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/nodejs/node/issues/43994 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven co.fs2:fs2-io
>=3.1.0, <3.2.11
3.2.11
maven co.fs2:fs2-io_2.12
>=3.1.0, <3.2.11
3.2.11
maven co.fs2:fs2-io_3
>=3.1.0, <3.2.11
3.2.11
maven co.fs2:fs2-io_2.13
>=3.1.0, <3.2.11
3.2.11
maven co.fs2:fs2-io_sjs1_2.13
>=3.1.0, <3.2.11
3.2.11
maven co.fs2:fs2-io_sjs1_3
>=3.1.0, <3.2.11
3.2.11

Affected products

  • typelevel fs2

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.