Vulnerability-Lookup

RHSA-2023:4537

Vulnerability from csaf_opensuse - Published: 2023-08-08 00:00 - Updated: 2026-09-20 11:30

Summary

security update for nodejs

Severity

Low

Notes

Title of the patch: security update for nodejs

Description of the patch: This security update provides a functional equivalent of RHSA-2023:4537. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2023:4537.

Patchnames: RHSA-2023:4537

CVE-2023-30581

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 7 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16	—	Vendor Fix

Threats

Impact important

CVE-2023-30588

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 7 products, the same list as for CVE-2023-30581

Threats

Impact moderate

CVE-2023-30589

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 7 products, the same list as for CVE-2023-30581

Threats

Impact moderate

CVE-2023-30590

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 7 products, the same list as for CVE-2023-30581

Threats

Impact moderate

References

14 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://www.suse.com/security/cve/CVE-2023-30581/	self
https://www.suse.com/security/cve/CVE-2023-30588/	self
https://www.suse.com/security/cve/CVE-2023-30589/	self
https://www.suse.com/security/cve/CVE-2023-30590/	self
https://www.suse.com/security/cve/CVE-2023-30581	external
https://bugzilla.suse.com/1212574	external
https://www.suse.com/security/cve/CVE-2023-30588	external
https://bugzilla.suse.com/1212581	external
https://www.suse.com/security/cve/CVE-2023-30589	external
https://bugzilla.suse.com/1212582	external
https://www.suse.com/security/cve/CVE-2023-30590	external
https://bugzilla.suse.com/1212583	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for nodejs",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2023:4537.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2023:4537.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2023:4537",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2023_4537.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-30581 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-30581/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-30588 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-30588/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-30589 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-30589/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-30590 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-30590/"
      }
    ],
    "title": "security update for nodejs",
    "tracking": {
      "current_release_date": "2026-09-20T11:30:36Z",
      "generator": {
        "date": "2023-08-08T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2023:4537",
      "initial_release_date": "2023-08-08T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-08-08T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:30:36Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
                "product": {
                  "name": "nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch (nodejs:16)",
                  "product_id": "nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-docs@16.20.1-1.module+el8.8.0+19440+ee8dbee5?arch=noarch\u0026rpmmod=nodejs:16:8000020230808183219:rhel8\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
                "product": {
                  "name": "nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch (nodejs:16)",
                  "product_id": "nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-nodemon@2.0.20-3.module+el8.8.0+19038+6f60344f?arch=noarch\u0026rpmmod=nodejs:16:8000020230808183219:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
                "product": {
                  "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch (nodejs:16)",
                  "product_id": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-packaging@25-1.module+el8.5.0+10992+fac5fe06?arch=noarch\u0026rpmmod=nodejs:16:8000020221216183717:rhel8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
                "product": {
                  "name": "nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64 (nodejs:16)",
                  "product_id": "nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:nodejs:node.js:16.20.1:*:*:*:-:*:*:*",
                    "purl": "pkg:rpm/suse/nodejs@16.20.1-1.module+el8.8.0+19440+ee8dbee5?arch=x86_64\u0026rpmmod=nodejs:16:8000020230808183219:rhel8\u0026epoch=1\u0026upstream=nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
                "product": {
                  "name": "nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64 (nodejs:16)",
                  "product_id": "nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-devel@16.20.1-1.module+el8.8.0+19440+ee8dbee5?arch=x86_64\u0026rpmmod=nodejs:16:8000020230808183219:rhel8\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
                "product": {
                  "name": "nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64 (nodejs:16)",
                  "product_id": "nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-full-i18n@16.20.1-1.module+el8.8.0+19440+ee8dbee5?arch=x86_64\u0026rpmmod=nodejs:16:8000020230808183219:rhel8\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
                "product": {
                  "name": "npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64 (nodejs:16)",
                  "product_id": "npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/npm@8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5?arch=x86_64\u0026rpmmod=nodejs:16:8000020230808183219:rhel8\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
        },
        "product_reference": "nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
        },
        "product_reference": "nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16"
        },
        "product_reference": "nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
        },
        "product_reference": "nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16"
        },
        "product_reference": "nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16"
        },
        "product_reference": "nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
        },
        "product_reference": "npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-30581",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-30581"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
          "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-30581",
          "url": "https://www.suse.com/security/cve/CVE-2023-30581"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1212574 for CVE-2023-30581",
          "url": "https://bugzilla.suse.com/1212574"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
            "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
            "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-08-08T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-30581"
    },
    {
      "cve": "CVE-2023-30588",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-30588"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
          "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-30588",
          "url": "https://www.suse.com/security/cve/CVE-2023-30588"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1212581 for CVE-2023-30588",
          "url": "https://bugzilla.suse.com/1212581"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
            "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
            "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-08-08T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-30588"
    },
    {
      "cve": "CVE-2023-30589",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-30589"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).\r\n\r\nThe CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
          "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-30589",
          "url": "https://www.suse.com/security/cve/CVE-2023-30589"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1212582 for CVE-2023-30589",
          "url": "https://bugzilla.suse.com/1212582"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
            "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
            "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-08-08T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-30589"
    },
    {
      "cve": "CVE-2023-30590",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-30590"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: \"Generates private and public Diffie-Hellman key values\".\n\nThe documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
          "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
          "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-30590",
          "url": "https://www.suse.com/security/cve/CVE-2023-30590"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1212583 for CVE-2023-30590",
          "url": "https://bugzilla.suse.com/1212583"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
            "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-devel-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-docs-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:16.20.1-1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:2.0.20-3.module+el8.8.0+19038+6f60344f.noarch::nodejs:16",
            "SUSE Liberty Linux 8:nodejs-packaging-0:25-1.module+el8.5.0+10992+fac5fe06.noarch::nodejs:16",
            "SUSE Liberty Linux 8:npm-1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5.x86_64::nodejs:16"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-08-08T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-30590"
    }
  ]
}

CVE-2023-30581 (GCVE-0-2023-30581)

Vulnerability from cvelistv5 – Published: 2023-11-22 23:28 – Updated: 2025-11-03 21:48

Summary

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-05 14:18 UTC

CWE

CWE-862 - Missing Authorization

Assigner

hackerone mitre root Scorecard

References

2 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/june-202…
https://security.netapp.com/advisory/ntap-2024110…

Impacted products

1 product

Vendor	Product	Version
NodeJS	Node	Affected: 4.0 , < 4.* (semver) Affected: 5.0 , < 5.* (semver) Affected: 6.0 , < 6.* (semver) Affected: 7.0 , < 7.* (semver) Affected: 8.0 , < 8.* (semver) Affected: 9.0 , < 9.* (semver) Affected: 10.0 , < 10.* (semver) Affected: 11.0 , < 11.* (semver) Affected: 12.0 , < 12.* (semver) Affected: 13.0 , < 13.* (semver) Affected: 14.0 , < 14.* (semver) Affected: 15.0 , < 15.* (semver) Affected: 16.0 , < 16.20.1 (semver) Affected: 17.0 , < 17.* (semver) Affected: 18.0 , < 18.16.1 (semver) Affected: 19.0 , < 19.* (semver) Affected: 20.0 , < 20.3.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:48:01.028Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241101-0011/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-30581",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-05T14:18:07.496118Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-05T14:19:27.519Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.20.1",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.16.1",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            },
            {
              "lessThan": "20.3.1",
              "status": "affected",
              "version": "20.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T22:24:49.919Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-30581",
    "datePublished": "2023-11-22T23:28:30.768Z",
    "dateReserved": "2023-04-13T01:00:12.085Z",
    "dateUpdated": "2025-11-03T21:48:01.028Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-30588 (GCVE-0-2023-30588)

Vulnerability from cvelistv5 – Published: 2023-11-28 19:15 – Updated: 2025-11-03 21:48

Summary

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Severity

No CVSS data available.

Assigner

hackerone mitre root Scorecard

References

3 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/june-202…
https://security.netapp.com/advisory/ntap-2024062…
https://security.netapp.com/advisory/ntap-2024110…

Impacted products

1 product

Vendor	Product	Version
NodeJS	Node	Affected: 4.0 , < 4.* (semver) Affected: 5.0 , < 5.* (semver) Affected: 6.0 , < 6.* (semver) Affected: 7.0 , < 7.* (semver) Affected: 8.0 , < 8.* (semver) Affected: 9.0 , < 9.* (semver) Affected: 10.0 , < 10.* (semver) Affected: 11.0 , < 11.* (semver) Affected: 12.0 , < 12.* (semver) Affected: 13.0 , < 13.* (semver) Affected: 14.0 , < 14.* (semver) Affected: 15.0 , < 15.* (semver) Affected: 16.0 , < 16.20.1 (semver) Affected: 17.0 , < 17.* (semver) Affected: 18.0 , < 18.16.1 (semver) Affected: 19.0 , < 19.* (semver) Affected: 20.0 , < 20.3.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:48:04.920Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241101-0011/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.20.1",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.16.1",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            },
            {
              "lessThan": "20.3.1",
              "status": "affected",
              "version": "20.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T22:24:56.773Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-30588",
    "datePublished": "2023-11-28T19:15:19.430Z",
    "dateReserved": "2023-04-13T01:00:12.086Z",
    "dateUpdated": "2025-11-03T21:48:04.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-30589 (GCVE-0-2023-30589)

Vulnerability from cvelistv5 – Published: 2023-06-30 23:39 – Updated: 2025-11-04 16:10

Summary

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

Severity

No CVSS data available.

Assigner

hackerone mitre root Scorecard

References

10 references

URL	Tags
https://hackerone.com/reports/2001873
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://security.netapp.com/advisory/ntap-2023080…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://security.netapp.com/advisory/ntap-2024062…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

1 product

Vendor	Product	Version
NodeJS	Node	Affected: 4.0 , < 4.* (semver) Affected: 5.0 , < 5.* (semver) Affected: 6.0 , < 6.* (semver) Affected: 7.0 , < 7.* (semver) Affected: 8.0 , < 8.* (semver) Affected: 9.0 , < 9.* (semver) Affected: 10.0 , < 10.* (semver) Affected: 11.0 , < 11.* (semver) Affected: 12.0 , < 12.* (semver) Affected: 13.0 , < 13.* (semver) Affected: 14.0 , < 14.* (semver) Affected: 15.0 , < 15.* (semver) Affected: 16.0 , < 16.20.1 (semver) Affected: 17.0 , < 17.* (semver) Affected: 18.0 , < 18.16.1 (semver) Affected: 19.0 , < 19.* (semver) Affected: 20.0 , < 20.3.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:10:09.729Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/2001873"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230803-0009/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.20.1",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.16.1",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            },
            {
              "lessThan": "20.3.1",
              "status": "affected",
              "version": "20.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).\r\n\r\nThe CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T22:24:55.930Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/2001873"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230803-0009/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-30589",
    "datePublished": "2023-06-30T23:39:59.161Z",
    "dateReserved": "2023-04-13T01:00:12.086Z",
    "dateUpdated": "2025-11-04T16:10:09.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-30590 (GCVE-0-2023-30590)

Vulnerability from cvelistv5 – Published: 2023-11-28 19:15 – Updated: 2025-11-04 16:10

Summary

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.

Severity

No CVSS data available.

Assigner

hackerone mitre root Scorecard

References

4 references

URL	Tags
https://nodejs.org/en/blog/vulnerability/june-202…
https://lists.debian.org/debian-lts-announce/2024…
https://security.netapp.com/advisory/ntap-2024110…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

1 product

Vendor	Product	Version
NodeJS	Node	Affected: 4.0 , < 4.* (semver) Affected: 5.0 , < 5.* (semver) Affected: 6.0 , < 6.* (semver) Affected: 7.0 , < 7.* (semver) Affected: 8.0 , < 8.* (semver) Affected: 9.0 , < 9.* (semver) Affected: 10.0 , < 10.* (semver) Affected: 11.0 , < 11.* (semver) Affected: 12.0 , < 12.* (semver) Affected: 13.0 , < 13.* (semver) Affected: 14.0 , < 14.* (semver) Affected: 15.0 , < 15.* (semver) Affected: 16.0 , < 16.20.1 (semver) Affected: 17.0 , < 17.* (semver) Affected: 18.0 , < 18.16.1 (semver) Affected: 19.0 , < 19.* (semver) Affected: 20.0 , < 20.3.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:10:10.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241101-0011/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Node",
          "vendor": "NodeJS",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.20.1",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.16.1",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            },
            {
              "lessThan": "20.3.1",
              "status": "affected",
              "version": "20.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: \"Generates private and public Diffie-Hellman key values\".\n\nThe documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-30T22:24:57.627Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2023-30590",
    "datePublished": "2023-11-28T19:15:19.447Z",
    "dateReserved": "2023-04-13T01:00:12.086Z",
    "dateUpdated": "2025-11-04T16:10:10.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2023:4537

CVE-2023-30581 (GCVE-0-2023-30581)

CVE-2023-30588 (GCVE-0-2023-30588)

CVE-2023-30589 (GCVE-0-2023-30589)

CVE-2023-30590 (GCVE-0-2023-30590)

Tags

Sightings

Nomenclature

Related by attack behaviour