# Remotely trigger an assertion on a TLS server with a malformed certificate string

A client certificate with a type-19 (x400Address) string in subjectAltName crashes a Node.js TLS server that calls getPeerCertificate(), enabling remote DoS.

- Payout: hidden
- Severity: critical
- Program: Node.js
- Found by: rogierschouten
- Disclosed: 2020-02-06
- CVE: CVE-2019-15604
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/746733
- Library page: https://bugbountylibrary.com/r/h1%3A746733
- Tags: area:devices domain:network impact:dos kind:bounty platform:hackerone sev:critical tech:nodejs technique:fuzzing vuln:dos vuln:memory-corruption

**Target:** Node.js TLS server (node_crypto.cc getPeerCertificate)
**Root cause:** Node's certificate parsing in node_crypto.cc hits an assertion when a peer certificate's subjectAltName contains a GeneralName of type 19 (x400Address), which the parser does not handle.
**Steps:**
1. Generate a client cert with no common name and a subjectAltName containing a type-19 string (e.g. via node-forge).
2. Run a TLS server with `requestCert: true, rejectUnauthorized: true` that calls `socket.getPeerCertificate()` in the connection handler.
3. Connect with the malformed client cert (`node ./client.js`).
4. Server hits an assertion in node_crypto.cc and crashes.
**How found:** Author noted the inverse of issue #30521 (client crash) and hypothesized the server side would crash symmetrically when parsing a malformed SAN; crafted certs with node-forge to confirm.
**Exploitation:** Any remote client presenting the crafted certificate to a TLS server that reads the peer certificate triggers the assertion, crashing the process (DoS).
**Insight:** Certificate SAN GeneralName types beyond the common ones (DNS/IP/URI) are rarely fuzzed; crafting certs with unusual GeneralName type tags (e.g. x400Address type 19) can hit unhandled branches/assertions in TLS parsers on either client or server side.