What is CVE-2022-31183?

CVE-2022-31183 is a critical-severity vulnerability in Typelevel Fs2, classified under Improper Certificate Validation. CVSS score: 9.1/10. Published 2022-08-01.

How severe is CVE-2022-31183?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Typelevel Fs2

CVE-2022-31183

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. `fs2-io` running on Node.js. The JVM TLS implementation is completely independent. 2. `TLSSocket`s in server-mode. Client-mode `TLSSocket`s are implemented via a different API. 3. mTLS as enabled via `requestCert = true` in `TLSParameters`. The default setting is `false` for server-mode `TLSSocket`s. It was introduced with the initial Node.js implementation of fs2-io in 3.1.0. A patch is released in v3.2.11. The requestCert = true parameter is respected and the peer certificate is verified. If verification fails, a SSLException is raised. If using an unpatched version on Node.js, do not use a server-mode TLSSocket with requestCert = true to establish a mTLS connection.

Vulnerability class: Improper Certificate Validation

Published 2022-08-01 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.008 (55.1th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: +0.000

Affected products

Typelevel Fs2 — versions >= 3.1.0, < 3.2.11

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

References

github.com/typelevel/fs2/security/advisories/GHSA-2cpx-6pqp-wf35 (Third Party Advisory)
github.com/nodejs/node/issues/43994 (Exploit, Third Party Advisory, Issue Tracking)
github.com/typelevel/fs2/commit/659824395826a314e0a4331535dbf1ef8bef8207 (Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2022-31183?: CVE-2022-31183 is a critical-severity vulnerability in Typelevel Fs2, classified under Improper Certificate Validation. CVSS score: 9.1/10. Published 2022-08-01.
How severe is CVE-2022-31183?: Critical severity. CVSS v3 base score is 9.1 out of 10.