Vulnerability-Lookup

OESA-2023-1551 (CVE-2022-25881)

Vulnerability from osv_openeuler – Published: 2023-09-02 11:06 – Updated: 2026-08-06 11:06 – Source website

Summary

nodejs security update

Details

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

(CVE-2022-25881)

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.(CVE-2022-32212)

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).(CVE-2022-32213)

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).(CVE-2022-32214)

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).(CVE-2022-32215)

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.(CVE-2022-35256)

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.(CVE-2023-23918)

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.(CVE-2023-23920)

The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.

References: https://nodejs.org/en/blog/vulnerability/june-2023-security-releases(CVE-2023-30581)

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 (CVE-2023-30589)

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet.

References: https://nodejs.org/en/blog/vulnerability/june-2023-security-releases(CVE-2023-30590)

The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.

This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.

Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.(CVE-2023-32002)

The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.

This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.

Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.(CVE-2023-32006)

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.(CVE-2023-32559)

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/en/security/safety-bull…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-25881	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-32212	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-32213	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-32214	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-32215	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2022-35256	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-23918	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-23920	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-30581	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-30589	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-30590	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-32002	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-32006	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2023-32559	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "nodejs-debuginfo-12.22.11-4.oe1.aarch64.rpm",
          "nodejs-full-i18n-12.22.11-4.oe1.aarch64.rpm",
          "npm-6.14.16-1.12.22.11.4.oe1.aarch64.rpm",
          "nodejs-12.22.11-4.oe1.aarch64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.4.oe1.aarch64.rpm",
          "nodejs-debugsource-12.22.11-4.oe1.aarch64.rpm",
          "nodejs-libs-12.22.11-4.oe1.aarch64.rpm",
          "nodejs-devel-12.22.11-4.oe1.aarch64.rpm"
        ],
        "noarch": [
          "nodejs-docs-12.22.11-4.oe1.noarch.rpm"
        ],
        "src": [
          "nodejs-12.22.11-4.oe1.src.rpm"
        ],
        "x86_64": [
          "nodejs-12.22.11-4.oe1.x86_64.rpm",
          "npm-6.14.16-1.12.22.11.4.oe1.x86_64.rpm",
          "nodejs-debugsource-12.22.11-4.oe1.x86_64.rpm",
          "nodejs-devel-12.22.11-4.oe1.x86_64.rpm",
          "nodejs-debuginfo-12.22.11-4.oe1.x86_64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.4.oe1.x86_64.rpm",
          "nodejs-full-i18n-12.22.11-4.oe1.x86_64.rpm",
          "nodejs-libs-12.22.11-4.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "nodejs",
        "purl": "pkg:rpm/openEuler/nodejs\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.22.11-4.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "nodejs-full-i18n-12.22.11-4.oe1.aarch64.rpm",
          "nodejs-devel-12.22.11-4.oe1.aarch64.rpm",
          "nodejs-libs-12.22.11-4.oe1.aarch64.rpm",
          "nodejs-debuginfo-12.22.11-4.oe1.aarch64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.4.oe1.aarch64.rpm",
          "npm-6.14.16-1.12.22.11.4.oe1.aarch64.rpm",
          "nodejs-12.22.11-4.oe1.aarch64.rpm",
          "nodejs-debugsource-12.22.11-4.oe1.aarch64.rpm"
        ],
        "noarch": [
          "nodejs-docs-12.22.11-4.oe1.noarch.rpm"
        ],
        "src": [
          "nodejs-12.22.11-4.oe1.src.rpm"
        ],
        "x86_64": [
          "nodejs-devel-12.22.11-4.oe1.x86_64.rpm",
          "nodejs-debugsource-12.22.11-4.oe1.x86_64.rpm",
          "npm-6.14.16-1.12.22.11.4.oe1.x86_64.rpm",
          "nodejs-12.22.11-4.oe1.x86_64.rpm",
          "nodejs-libs-12.22.11-4.oe1.x86_64.rpm",
          "nodejs-full-i18n-12.22.11-4.oe1.x86_64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.4.oe1.x86_64.rpm",
          "nodejs-debuginfo-12.22.11-4.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP3",
        "name": "nodejs",
        "purl": "pkg:rpm/openEuler/nodejs\u0026distro=openEuler-20.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.22.11-4.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "nodejs-debuginfo-12.22.11-6.oe2203.aarch64.rpm",
          "nodejs-devel-12.22.11-6.oe2203.aarch64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.6.oe2203.aarch64.rpm",
          "nodejs-12.22.11-6.oe2203.aarch64.rpm",
          "nodejs-full-i18n-12.22.11-6.oe2203.aarch64.rpm",
          "npm-6.14.16-1.12.22.11.6.oe2203.aarch64.rpm",
          "nodejs-debugsource-12.22.11-6.oe2203.aarch64.rpm",
          "nodejs-libs-12.22.11-6.oe2203.aarch64.rpm",
          "npm-6.14.16-1.12.22.11.5.oe2203sp1.aarch64.rpm",
          "nodejs-full-i18n-12.22.11-5.oe2203sp1.aarch64.rpm",
          "nodejs-libs-12.22.11-5.oe2203sp1.aarch64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.5.oe2203sp1.aarch64.rpm",
          "nodejs-12.22.11-5.oe2203sp1.aarch64.rpm",
          "nodejs-devel-12.22.11-5.oe2203sp1.aarch64.rpm",
          "nodejs-debuginfo-12.22.11-5.oe2203sp1.aarch64.rpm",
          "nodejs-debugsource-12.22.11-5.oe2203sp1.aarch64.rpm",
          "nodejs-debuginfo-12.22.11-5.oe2203sp2.aarch64.rpm",
          "nodejs-devel-12.22.11-5.oe2203sp2.aarch64.rpm",
          "nodejs-full-i18n-12.22.11-5.oe2203sp2.aarch64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.5.oe2203sp2.aarch64.rpm",
          "nodejs-libs-12.22.11-5.oe2203sp2.aarch64.rpm",
          "nodejs-12.22.11-5.oe2203sp2.aarch64.rpm",
          "npm-6.14.16-1.12.22.11.5.oe2203sp2.aarch64.rpm",
          "nodejs-debugsource-12.22.11-5.oe2203sp2.aarch64.rpm"
        ],
        "noarch": [
          "nodejs-docs-12.22.11-6.oe2203.noarch.rpm",
          "nodejs-docs-12.22.11-5.oe2203sp1.noarch.rpm",
          "nodejs-docs-12.22.11-5.oe2203sp2.noarch.rpm"
        ],
        "src": [
          "nodejs-12.22.11-6.oe2203.src.rpm",
          "nodejs-12.22.11-5.oe2203sp1.src.rpm",
          "nodejs-12.22.11-5.oe2203sp2.src.rpm"
        ],
        "x86_64": [
          "v8-devel-7.8.279.23-1.12.22.11.6.oe2203.x86_64.rpm",
          "nodejs-debugsource-12.22.11-6.oe2203.x86_64.rpm",
          "nodejs-12.22.11-6.oe2203.x86_64.rpm",
          "nodejs-devel-12.22.11-6.oe2203.x86_64.rpm",
          "nodejs-libs-12.22.11-6.oe2203.x86_64.rpm",
          "npm-6.14.16-1.12.22.11.6.oe2203.x86_64.rpm",
          "nodejs-full-i18n-12.22.11-6.oe2203.x86_64.rpm",
          "nodejs-debuginfo-12.22.11-6.oe2203.x86_64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.5.oe2203sp1.x86_64.rpm",
          "nodejs-libs-12.22.11-5.oe2203sp1.x86_64.rpm",
          "nodejs-debuginfo-12.22.11-5.oe2203sp1.x86_64.rpm",
          "nodejs-12.22.11-5.oe2203sp1.x86_64.rpm",
          "npm-6.14.16-1.12.22.11.5.oe2203sp1.x86_64.rpm",
          "nodejs-full-i18n-12.22.11-5.oe2203sp1.x86_64.rpm",
          "nodejs-devel-12.22.11-5.oe2203sp1.x86_64.rpm",
          "nodejs-debugsource-12.22.11-5.oe2203sp1.x86_64.rpm",
          "nodejs-debugsource-12.22.11-5.oe2203sp2.x86_64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.5.oe2203sp2.x86_64.rpm",
          "nodejs-debuginfo-12.22.11-5.oe2203sp2.x86_64.rpm",
          "nodejs-full-i18n-12.22.11-5.oe2203sp2.x86_64.rpm",
          "npm-6.14.16-1.12.22.11.5.oe2203sp2.x86_64.rpm",
          "nodejs-libs-12.22.11-5.oe2203sp2.x86_64.rpm",
          "nodejs-12.22.11-5.oe2203sp2.x86_64.rpm",
          "nodejs-devel-12.22.11-5.oe2203sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS",
        "name": "nodejs",
        "purl": "pkg:rpm/openEuler/nodejs\u0026distro=openEuler-22.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.22.11-5.oe2203sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "npm-6.14.16-1.12.22.11.5.oe2203sp1.aarch64.rpm",
          "nodejs-full-i18n-12.22.11-5.oe2203sp1.aarch64.rpm",
          "nodejs-libs-12.22.11-5.oe2203sp1.aarch64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.5.oe2203sp1.aarch64.rpm",
          "nodejs-12.22.11-5.oe2203sp1.aarch64.rpm",
          "nodejs-devel-12.22.11-5.oe2203sp1.aarch64.rpm",
          "nodejs-debuginfo-12.22.11-5.oe2203sp1.aarch64.rpm",
          "nodejs-debugsource-12.22.11-5.oe2203sp1.aarch64.rpm"
        ],
        "noarch": [
          "nodejs-docs-12.22.11-5.oe2203sp1.noarch.rpm"
        ],
        "src": [
          "nodejs-12.22.11-5.oe2203sp1.src.rpm"
        ],
        "x86_64": [
          "v8-devel-7.8.279.23-1.12.22.11.5.oe2203sp1.x86_64.rpm",
          "nodejs-libs-12.22.11-5.oe2203sp1.x86_64.rpm",
          "nodejs-debuginfo-12.22.11-5.oe2203sp1.x86_64.rpm",
          "nodejs-12.22.11-5.oe2203sp1.x86_64.rpm",
          "npm-6.14.16-1.12.22.11.5.oe2203sp1.x86_64.rpm",
          "nodejs-full-i18n-12.22.11-5.oe2203sp1.x86_64.rpm",
          "nodejs-devel-12.22.11-5.oe2203sp1.x86_64.rpm",
          "nodejs-debugsource-12.22.11-5.oe2203sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP1",
        "name": "nodejs",
        "purl": "pkg:rpm/openEuler/nodejs\u0026distro=openEuler-22.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.22.11-5.oe2203sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "nodejs-debuginfo-12.22.11-5.oe2203sp2.aarch64.rpm",
          "nodejs-devel-12.22.11-5.oe2203sp2.aarch64.rpm",
          "nodejs-full-i18n-12.22.11-5.oe2203sp2.aarch64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.5.oe2203sp2.aarch64.rpm",
          "nodejs-libs-12.22.11-5.oe2203sp2.aarch64.rpm",
          "nodejs-12.22.11-5.oe2203sp2.aarch64.rpm",
          "npm-6.14.16-1.12.22.11.5.oe2203sp2.aarch64.rpm",
          "nodejs-debugsource-12.22.11-5.oe2203sp2.aarch64.rpm"
        ],
        "noarch": [
          "nodejs-docs-12.22.11-5.oe2203sp2.noarch.rpm"
        ],
        "src": [
          "nodejs-12.22.11-5.oe2203sp2.src.rpm"
        ],
        "x86_64": [
          "nodejs-debugsource-12.22.11-5.oe2203sp2.x86_64.rpm",
          "v8-devel-7.8.279.23-1.12.22.11.5.oe2203sp2.x86_64.rpm",
          "nodejs-debuginfo-12.22.11-5.oe2203sp2.x86_64.rpm",
          "nodejs-full-i18n-12.22.11-5.oe2203sp2.x86_64.rpm",
          "npm-6.14.16-1.12.22.11.5.oe2203sp2.x86_64.rpm",
          "nodejs-libs-12.22.11-5.oe2203sp2.x86_64.rpm",
          "nodejs-12.22.11-5.oe2203sp2.x86_64.rpm",
          "nodejs-devel-12.22.11-5.oe2203sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP2",
        "name": "nodejs",
        "purl": "pkg:rpm/openEuler/nodejs\u0026distro=openEuler-22.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.22.11-5.oe2203sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Node.js is a platform built on Chrome\u0027s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\r\n\r\nThis affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.\r\n\r\n(CVE-2022-25881)\r\n\r\nA OS Command Injection vulnerability exists in Node.js versions \u0026lt;14.20.0, \u0026lt;16.20.0, \u0026lt;18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.(CVE-2022-32212)\r\n\r\nThe llhttp parser \u0026lt;v14.20.1, \u0026lt;v16.17.1 and \u0026lt;v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).(CVE-2022-32213)\r\n\r\nThe llhttp parser \u0026lt;v14.20.1, \u0026lt;v16.17.1 and \u0026lt;v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).(CVE-2022-32214)\r\n\r\nThe llhttp parser \u0026lt;v14.20.1, \u0026lt;v16.17.1 and \u0026lt;v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).(CVE-2022-32215)\r\n\r\nThe llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.(CVE-2022-35256)\r\n\r\nA privilege escalation vulnerability exists in Node.js \u0026lt;19.6.1, \u0026lt;18.14.1, \u0026lt;16.19.1 and \u0026lt;14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.(CVE-2023-23918)\r\n\r\nAn untrusted search path vulnerability exists in Node.js. \u0026lt;19.6.1, \u0026lt;18.14.1, \u0026lt;16.19.1, and \u0026lt;14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.(CVE-2023-23920)\r\n\r\nThe use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.\r\n\r\nReferences:\nhttps://nodejs.org/en/blog/vulnerability/june-2023-security-releases(CVE-2023-30581)\r\n\r\nThe llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).\r\n\r\nThe CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20\n(CVE-2023-30589)\r\n\r\nThe generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet.\r\n\r\nReferences:\nhttps://nodejs.org/en/blog/vulnerability/june-2023-security-releases(CVE-2023-30590)\r\n\r\nThe use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\r\n\r\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.\r\n\r\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.(CVE-2023-32002)\r\n\r\nThe use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\r\n\r\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.\r\n\r\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.(CVE-2023-32006)\r\n\r\nA privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding(\u0026apos;spawn_sync\u0026apos;)` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.(CVE-2023-32559)",
  "id": "OESA-2023-1551",
  "modified": "2026-08-06T11:06:00Z",
  "published": "2023-09-02T11:06:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1551"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32212"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32213"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32214"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32215"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35256"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23918"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23920"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30581"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30589"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30590"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32002"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32006"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32559"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "nodejs security update",
  "upstream": [
    "CVE-2022-25881",
    "CVE-2022-32212",
    "CVE-2022-32213",
    "CVE-2022-32214",
    "CVE-2022-32215",
    "CVE-2022-35256",
    "CVE-2023-23918",
    "CVE-2023-23920",
    "CVE-2023-30581",
    "CVE-2023-30589",
    "CVE-2023-30590",
    "CVE-2023-32002",
    "CVE-2023-32006",
    "CVE-2023-32559"
  ]
}

CVE-2023-30590 (GCVE-0-2023-30590)

Vulnerability from cvelistv5 – Published: 2023-11-28 19:15 – Updated: 2025-11-04 16:10

Summary

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.

Severity

No CVSS data available.

Assigner

hackerone mitre root

References

4 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/june-202…
https://lists.debian.org/debian-lts-announce/2024…
https://security.netapp.com/advisory/ntap-2024110…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

1 product

Vendor	Product	Version
NodeJS	Node	Affected: 4.0 , < 4.* (semver) Affected: 5.0 , < 5.* (semver) Affected: 6.0 , < 6.* (semver) Affected: 7.0 , < 7.* (semver) Affected: 8.0 , < 8.* (semver) Affected: 9.0 , < 9.* (semver) Affected: 10.0 , < 10.* (semver) Affected: 11.0 , < 11.* (semver) Affected: 12.0 , < 12.* (semver) Affected: 13.0 , < 13.* (semver) Affected: 14.0 , < 14.* (semver) Affected: 15.0 , < 15.* (semver) Affected: 16.0 , < 16.20.1 (semver) Affected: 17.0 , < 17.* (semver) Affected: 18.0 , < 18.16.1 (semver) Affected: 19.0 , < 19.* (semver) Affected: 20.0 , < 20.3.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:10:10.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241101-0011/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.20.1",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.16.1",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            },
            {
              "lessThan": "20.3.1",
              "status": "affected",
              "version": "20.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: \"Generates private and public Diffie-Hellman key values\".\n\nThe documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T22:24:57.627Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-30590",
    "datePublished": "2023-11-28T19:15:19.447Z",
    "dateReserved": "2023-04-13T01:00:12.086Z",
    "dateUpdated": "2025-11-04T16:10:10.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-32002 (GCVE-0-2023-32002)

Vulnerability from cvelistv5 – Published: 2023-08-21 16:52 – Updated: 2025-07-02 14:48

Summary

The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-02 14:47 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

hackerone mitre root

References

2 references

URL	Tags
https://hackerone.com/reports/1960870
https://security.netapp.com/advisory/ntap-2023091…

Impacted products

2 products

Vendor	Product	Version
NodeJS	Node	Affected: 4.0 , < 4.* (semver) Affected: 5.0 , < 5.* (semver) Affected: 6.0 , < 6.* (semver) Affected: 7.0 , < 7.* (semver) Affected: 8.0 , < 8.* (semver) Affected: 9.0 , < 9.* (semver) Affected: 10.0 , < 10.* (semver) Affected: 11.0 , < 11.* (semver) Affected: 12.0 , < 12.* (semver) Affected: 13.0 , < 13.* (semver) Affected: 14.0 , < 14.* (semver) Affected: 15.0 , < 15.* (semver) Affected: 16.0 , < 16.20.2 (semver) Affected: 17.0 , < 17.* (semver) Affected: 18.0 , < 18.17.1 (semver) Affected: 19.0 , < 19.* (semver) Affected: 20.0 , < 20.5.1 (semver)
nodejs	nodejs	Affected: 0 , ≤ 16.20.1 (semver) Affected: 0 , ≤ 18.17.0 (semver) Affected: 0 , ≤ 20.5.0 (semver) cpe:2.3:a:nodejs:nodejs::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:03:28.656Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1960870"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230915-0009/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nodejs",
            "vendor": "nodejs",
            "versions": [
              {
                "lessThanOrEqual": "16.20.1",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "18.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "20.5.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-32002",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-02T14:47:51.674813Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-288",
                "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-02T14:48:45.647Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.20.2",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.17.1",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            },
            {
              "lessThan": "20.5.1",
              "status": "affected",
              "version": "20.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T22:24:58.483Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/1960870"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230915-0009/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-32002",
    "datePublished": "2023-08-21T16:52:42.147Z",
    "dateReserved": "2023-05-01T01:00:12.220Z",
    "dateUpdated": "2025-07-02T14:48:45.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-32006 (GCVE-0-2023-32006)

Vulnerability from cvelistv5 – Published: 2023-08-15 15:10 – Updated: 2025-05-08 16:07

Summary

The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-08 20:20 UTC

CWE

CWE-693 - Protection Mechanism Failure

Assigner

hackerone mitre root

References

4 references

URL	Tags
https://hackerone.com/reports/2043807
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://security.netapp.com/advisory/ntap-2023091…

Impacted products

1 product

Vendor	Product	Version
NodeJS	Node	Affected: 4.0 , < 4.* (semver) Affected: 5.0 , < 5.* (semver) Affected: 6.0 , < 6.* (semver) Affected: 7.0 , < 7.* (semver) Affected: 8.0 , < 8.* (semver) Affected: 9.0 , < 9.* (semver) Affected: 10.0 , < 10.* (semver) Affected: 11.0 , < 11.* (semver) Affected: 12.0 , < 12.* (semver) Affected: 13.0 , < 13.* (semver) Affected: 14.0 , < 14.* (semver) Affected: 15.0 , < 15.* (semver) Affected: 16.0 , < 16.20.2 (semver) Affected: 17.0 , < 17.* (semver) Affected: 18.0 , < 18.17.1 (semver) Affected: 19.0 , < 19.* (semver) Affected: 20.0 , < 20.5.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:03:28.787Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/2043807"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230915-0009/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-32006",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-08T20:20:48.763469Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-08T16:07:02.197Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.20.2",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.17.1",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            },
            {
              "lessThan": "20.5.1",
              "status": "affected",
              "version": "20.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.\n\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T22:25:01.312Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/2043807"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230915-0009/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-32006",
    "datePublished": "2023-08-15T15:10:09.447Z",
    "dateReserved": "2023-05-01T01:00:12.220Z",
    "dateUpdated": "2025-05-08T16:07:02.197Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-32559 (GCVE-0-2023-32559)

Vulnerability from cvelistv5 – Published: 2023-08-24 01:23 – Updated: 2025-11-04 16:10

Summary

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-03 13:34 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

hackerone mitre root

References

3 references

URL	Tags
https://hackerone.com/reports/1946470
https://security.netapp.com/advisory/ntap-2023100…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
NodeJS	Node	Affected: 4.0 , < 4.* (semver) Affected: 5.0 , < 5.* (semver) Affected: 6.0 , < 6.* (semver) Affected: 7.0 , < 7.* (semver) Affected: 8.0 , < 8.* (semver) Affected: 9.0 , < 9.* (semver) Affected: 10.0 , < 10.* (semver) Affected: 11.0 , < 11.* (semver) Affected: 12.0 , < 12.* (semver) Affected: 13.0 , < 13.* (semver) Affected: 14.0 , < 14.* (semver) Affected: 15.0 , < 15.* (semver) Affected: 16.0 , < 16.20.2 (semver) Affected: 17.0 , < 17.* (semver) Affected: 18.0 , < 18.17.1 (semver) Affected: 19.0 , < 19.* (semver) Affected: 20.0 , < 20.5.1 (semver)
nodejs	nodejs	Affected: 0 , < 16.20.1 (semver) Affected: 0 , < 18.17.0 (semver) Affected: 0 , < 20.5.0 (semver) cpe:2.3:a:nodejs:nodejs::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:10:11.750Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1946470"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231006-0006/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nodejs",
            "vendor": "nodejs",
            "versions": [
              {
                "lessThan": "16.20.1",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThan": "18.17.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThan": "20.5.0",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-32559",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-03T13:34:58.374555Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T13:55:46.939Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.20.2",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.17.1",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            },
            {
              "lessThan": "20.5.1",
              "status": "affected",
              "version": "20.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding(\u0027spawn_sync\u0027)` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T22:25:02.569Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/1946470"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231006-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-32559",
    "datePublished": "2023-08-24T01:23:29.038Z",
    "dateReserved": "2023-05-10T01:00:12.523Z",
    "dateUpdated": "2025-11-04T16:10:11.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2023-1551 (CVE-2022-25881)

CVE-2023-30590 (GCVE-0-2023-30590)

CVE-2023-32002 (GCVE-0-2023-32002)

CVE-2023-32006 (GCVE-0-2023-32006)

CVE-2023-32559 (GCVE-0-2023-32559)

Tags

Sightings

Nomenclature

Related by attack behaviour