Every CVE Search/ Get API key

CVE-2023-38552

When the Node.js policy feature checks the integrity of a resource against a trusted manifest,...

7.5 HighFix available

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.24%Up 1.2 points since Oct 18, 2023
90%50%10%1%

What each source reports

NVD Score used 7.5

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Record
CVE-2023-38552
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-345
Updated
2026-11-02
CVE List No score

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Record
CVE-2023-38552
Updated
2026-11-02
EUVDEUVD-2023-42351 No score

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Record
EUVD-2023-42351
Updated
2026-11-02
GitHub AdvisoriesGHSA-x39v-frq9-5hh8 7.5

When the Node.js policy feature checks the integrity of a resource against a trusted manifest,...

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Record
GHSA-x39v-frq9-5hh8
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-345
Updated
2026-11-02
OSVALPINE-CVE-2023-38552 7.5

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Record
ALPINE-CVE-2023-38552
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSVAZL-31614 7.5

CVE-2023-38552 affecting package nodejs18 for versions less than 18.18.2-2

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Record
AZL-31614
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 28 moreShow less
OSVBELL-CVE-2023-38552 7.5
Record
BELL-CVE-2023-38552
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2023-38552 7.5

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Record
DEBIAN-CVE-2023-38552
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2023:5849 7.5

Red Hat Security Advisory: nodejs:18 security update

Record
RHSA-2023:5849
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2023:5869 7.5

Red Hat Security Advisory: nodejs:18 security update

Record
RHSA-2023:5869
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2023:7205 9.8

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2023:7205
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2023:5849 7.5

Important: nodejs:18 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)

  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)

  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:5849
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRLSA-2023:5869 7.5

Important: nodejs:18 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

A Rocky Enterprise Software Foundation Security Bulletin which addresses further details about this flaw is available in the References section.

  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)

  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)

  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:5869
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-38552 7.5

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Record
UBUNTU-CVE-2023-38552
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVALSA-2023:5849 No score

Important: nodejs:18 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)
  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:5849
Updated
2026-11-02
OSVALSA-2023:5869 No score

Important: nodejs:18 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

A AlmaLinux Security Bulletin which addresses further details about this flaw is available in the References section.

  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)
  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:5869
Updated
2026-11-02
OSVALSA-2023:7205 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • nodejs: permission model improperly protects against path traversal (CVE-2023-39331)
  • nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)
  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)
  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:7205
Updated
2026-11-02
OSVBIT-node-2023-38552 No score

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Record
BIT-node-2023-38552
Updated
2026-11-02
OSVBIT-node-min-2023-38552 No score

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Record
BIT-node-min-2023-38552
Updated
2026-11-02
OSVCLSA-2025-1761084810 No score

nodejs: Fix of CVE-2023-38552

  • CVE-2023-38552: use tamper-proof integrity check function to prevent tampering with Hash class internals in policy mechanism
Record
CLSA-2025-1761084810
Updated
2026-11-02
OSVCLSA-2026-1770216227 No score

nodejs: Fix of CVE-2023-38552

  • CVE-2023-38552: prevent application from intercepting integrity check operation and returning forged checksum
Record
CLSA-2026-1770216227
Updated
2026-11-02
OSV No score

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Record
CVE-2023-38552
Updated
2026-11-02
OSVMGASA-2023-0299 No score

Updated nodejs packages fix security vulnerabilities

This is a security release. The following CVEs are fixed in this release:

CVE-2023-44487: nghttp2 Security Release (High) CVE-2023-45143: undici Security Release (High) CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium) CVE-2023-39333: Code injection via WebAssembly export names (Low)

More detailed information on each of the vulnerabilities can be found in October 2023 Security Releases blog post.

Record
MGASA-2023-0299
Updated
2026-11-02
OSVopenSUSE-SU-2024:13337-1 No score

corepack20-20.8.1-1.1 on GA media

These are all security issues fixed in the corepack20-20.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13337-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13340-1 No score

nodejs-electron-25.9.1-2.1 on GA media

These are all security issues fixed in the nodejs-electron-25.9.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13340-1
Updated
2026-11-02
OSVRLSA-2023:7205 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

  • nodejs: permission model improperly protects against path traversal (CVE-2023-39331)

  • nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)

  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)

  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)

  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:7205
Updated
2026-11-02
OSVSUSE-SU-2023:4132-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • Update to version 18.18.2
  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
  • CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
Record
SUSE-SU-2023:4132-1
Updated
2026-11-02
OSVSUSE-SU-2023:4133-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • Update to version 18.18.2
  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
  • CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
Record
SUSE-SU-2023:4133-1
Updated
2026-11-02
OSVSUSE-SU-2023:4150-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • Update to version 18.18.2
  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
  • CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
Record
SUSE-SU-2023:4150-1
Updated
2026-11-02
OSVSUSE-SU-2023:4155-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • Update to version 18.18.2
  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
  • CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
Record
SUSE-SU-2023:4155-1
Updated
2026-11-02
OSVSUSE-SU-2023:4207-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • Update to version 18.18.2
  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
  • CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
Record
SUSE-SU-2023:4207-1
Updated
2026-11-02
OSVSUSE-SU-2023:4259-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
Record
SUSE-SU-2023:4259-1
Updated
2026-11-02
OSVSUSE-SU-2023:4373-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
Record
SUSE-SU-2023:4373-1
Updated
2026-11-02
OSVSUSE-SU-2023:4374-1 No score

Security update for nodejs12

This update for nodejs12 fixes the following issues:

  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
Record
SUSE-SU-2023:4374-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.17
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.18
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.19
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.20
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.21
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.22
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.23
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.24
 before 18.18.2-r0
18.18.2-r0
nodejs-current
Alpine:v3.18
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.19
 before 20.8.1-r0
20.8.1-r0
Show 136 moreShow less
Affected packages
PackageAffectedFixed
nodejs-current
Alpine:v3.20
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.21
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.22
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.23
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.24
 before 20.8.1-r0
20.8.1-r0
nodejs
AlmaLinux:9
 before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
1:18.18.2-2.module_el9.2.0+43+3ebc9e20
nodejs-devel
AlmaLinux:9
 before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
1:18.18.2-2.module_el9.2.0+43+3ebc9e20
nodejs-docs
AlmaLinux:9
 before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
1:18.18.2-2.module_el9.2.0+43+3ebc9e20
nodejs-full-i18n
AlmaLinux:9
 before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
1:18.18.2-2.module_el9.2.0+43+3ebc9e20
nodejs-nodemon
AlmaLinux:9
 before 3.0.1-1.module_el9.2.0+36+853e48f5
3.0.1-1.module_el9.2.0+36+853e48f5
nodejs-packaging
AlmaLinux:9
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
nodejs-packaging-bundler
AlmaLinux:9
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
npm
AlmaLinux:9
 before 1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20
1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20
nodejs
AlmaLinux:8
 before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
1:18.18.2-1.module_el8.8.0+3652+0e111ba0
nodejs-devel
AlmaLinux:8
 before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
1:18.18.2-1.module_el8.8.0+3652+0e111ba0
nodejs-docs
AlmaLinux:8
 before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
1:18.18.2-1.module_el8.8.0+3652+0e111ba0
nodejs-full-i18n
AlmaLinux:8
 before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
1:18.18.2-1.module_el8.8.0+3652+0e111ba0
nodejs-nodemon
AlmaLinux:8
 before 3.0.1-1.module_el8.8.0+3613+1ed8c91d
3.0.1-1.module_el8.8.0+3613+1ed8c91d
nodejs-packaging
AlmaLinux:8
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
nodejs-packaging-bundler
AlmaLinux:8
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
npm
AlmaLinux:8
 before 1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0
1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0
nodejs
AlmaLinux:8
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-devel
AlmaLinux:8
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-docs
AlmaLinux:8
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-full-i18n
AlmaLinux:8
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-nodemon
AlmaLinux:8
 before 3.0.1-1.module_el8.9.0+3675+0258a6d9
3.0.1-1.module_el8.9.0+3675+0258a6d9
nodejs-packaging
AlmaLinux:8
 before 2021.06-4.module_el8.9.0+3684+11b9e959
2021.06-4.module_el8.9.0+3684+11b9e959
nodejs-packaging-bundler
AlmaLinux:8
 before 2021.06-4.module_el8.9.0+3684+11b9e959
2021.06-4.module_el8.9.0+3684+11b9e959
npm
AlmaLinux:8
 before 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9
1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9
nodejs18
Azure Linux:2
 before 18.18.2-2
18.18.2-2
nodejs
Alpaquita:23
 18.16.0-r0 up to 18.18.2-r0
18.18.2-r0
nodejs
Alpaquita:stream
 18.16.1-r0 up to 18.18.2-r0
18.18.2-r0
nodejs
BellSoft Hardened Containers:23
 18.16.0-r0 up to 18.18.2-r0
18.18.2-r0
nodejs
BellSoft Hardened Containers:stream
 18.16.1-r0 up to 18.18.2-r0
18.18.2-r0
node
Bitnami
 before 18.18.2, 19.0.0 up to 20.8.1
18.18.220.8.1
node-min
Bitnami
 before 18.18.2, 19.0.0 up to 20.8.1
18.18.220.8.1
nodejs
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-3.el9_2.tuxcare.els13
1:16.20.2-3.el9_2.tuxcare.els13
nodejs-devel
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-3.el9_2.tuxcare.els13
1:16.20.2-3.el9_2.tuxcare.els13
nodejs-docs
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-3.el9_2.tuxcare.els13
1:16.20.2-3.el9_2.tuxcare.els13
nodejs-full-i18n
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-3.el9_2.tuxcare.els13
1:16.20.2-3.el9_2.tuxcare.els13
nodejs-libs
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-3.el9_2.tuxcare.els13
1:16.20.2-3.el9_2.tuxcare.els13
npm
TuxCare:AlmaLinux:9.2
 before 1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els13
1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els13
v8-devel
TuxCare:AlmaLinux:9.2
 before 2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els13
2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els13
nodejs
TuxCare:AlmaLinux:9.6
 before 1:16.20.2-8.el9_6.tuxcare.els2
1:16.20.2-8.el9_6.tuxcare.els2
nodejs-devel
TuxCare:AlmaLinux:9.6
 before 1:16.20.2-8.el9_6.tuxcare.els2
1:16.20.2-8.el9_6.tuxcare.els2
nodejs-docs
TuxCare:AlmaLinux:9.6
 before 1:16.20.2-8.el9_6.tuxcare.els2
1:16.20.2-8.el9_6.tuxcare.els2
nodejs-full-i18n
TuxCare:AlmaLinux:9.6
 before 1:16.20.2-8.el9_6.tuxcare.els2
1:16.20.2-8.el9_6.tuxcare.els2
nodejs-libs
TuxCare:AlmaLinux:9.6
 before 1:16.20.2-8.el9_6.tuxcare.els2
1:16.20.2-8.el9_6.tuxcare.els2
npm
TuxCare:AlmaLinux:9.6
 before 1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els2
1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els2
v8-devel
TuxCare:AlmaLinux:9.6
 before 2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els2
2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els2
nodejs
Debian:12
 before 18.19.0+dfsg-6~deb12u1, plus listed versions
18.13.0+dfsg1-118.13.0+dfsg1-1.118.19.0+dfsg-118.19.0+dfsg-218.19.0+dfsg-318.19.0+dfsg-418.19.0+dfsg-5
18.19.0+dfsg-6~deb12u1
nodejs
Debian:13
 before 18.13.0+dfsg1-1.1
18.13.0+dfsg1-1.1
nodejs
Debian:14
 before 18.13.0+dfsg1-1.1
18.13.0+dfsg1-1.1
nodejs
Mageia:9
 before 18.18.2-1.mga9
18.18.2-1.mga9
yarnpkg
Mageia:9
 before 1.22.19-14.mga9
1.22.19-14.mga9
nodejs
Red Hat:enterprise_linux:9::appstream
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-devel
Red Hat:enterprise_linux:9::appstream
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-docs
Red Hat:enterprise_linux:9::appstream
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0
0:3.0.1-1.module+el9.2.0.z+19753+58118bc0
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
npm
Red Hat:enterprise_linux:9::appstream
 before 1:9.8.1-1.18.18.2.2.module+el9.2.0.z+20408+7cb5fda5
1:9.8.1-1.18.18.2.2.module+el9.2.0.z+20408+7cb5fda5
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.1-1.module+el8.8.0+19757+8ca87034
0:3.0.1-1.module+el8.8.0+19757+8ca87034
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
npm
Red Hat:enterprise_linux:8::appstream
 before 1:9.8.1-1.18.18.2.1.module+el8.8.0+20407+c11d40bd
1:9.8.1-1.18.18.2.1.module+el8.8.0+20407+c11d40bd
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.1-1.module+el8.9.0+20473+c4e3d824
0:3.0.1-1.module+el8.9.0+20473+c4e3d824
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.9.0+19519+e25b965a
0:2021.06-4.module+el8.9.0+19519+e25b965a
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.9.0+19519+e25b965a
0:2021.06-4.module+el8.9.0+19519+e25b965a
npm
Red Hat:enterprise_linux:8::appstream
 before 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824
1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.7.0+40017+f0db1785
0:3.0.1-1.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.7.0+40018+a011993d
0:3.0.1-1.module+el9.7.0+40018+a011993d
nodejs-nodemon
Rocky Linux:9
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.7.0+40022+9ecc286c
0:2021.06-4.module+el9.7.0+40022+9ecc286c
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2
0:2021.06-4.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.7.0+40018+a011993d
0:2021.06-4.module+el9.7.0+40018+a011993d
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.7.0+40017+f0db1785
0:2021.06-4.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-packaging
Rocky Linux:8
 before 0:2021.06-4.module+el8.10.0+1989+e60144d9
0:2021.06-4.module+el8.10.0+1989+e60144d9
nodejs-packaging
Rocky Linux:8
 before 0:2021.06-4.module+el8.10.0+1988+437f3d23
0:2021.06-4.module+el8.10.0+1988+437f3d23
nodejs-packaging
Rocky Linux:8
 before 0:2021.06-4.module+el8.10.0+1824+532140ee
0:2021.06-4.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.8.0+1459+02651ab6
0:3.0.1-1.module+el8.8.0+1459+02651ab6
nodejs-packaging
Rocky Linux:8
 before 0:2021.06-4.module+el8.7.0+1072+5b168780
0:2021.06-4.module+el8.7.0+1072+5b168780
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 18.18.2-8.15.1
18.18.2-8.15.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
 before 18.18.2-150400.9.15.1
18.18.2-150400.9.15.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5
 before 18.18.2-150400.9.15.1
18.18.2-150400.9.15.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 16.20.2-8.36.1
16.20.2-8.36.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
 before 16.20.2-150400.3.27.2
16.20.2-150400.3.27.2
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs16
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs16
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs16
SUSE:Manager Server 4.2
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs16
SUSE:Enterprise Storage 7.1
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs14
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 14.21.3-6.49.1
14.21.3-6.49.1
nodejs14
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 14.21.3-150200.15.52.2
14.21.3-150200.15.52.2
nodejs14
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 14.21.3-150200.15.52.2
14.21.3-150200.15.52.2
nodejs14
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 14.21.3-150200.15.52.2
14.21.3-150200.15.52.2
nodejs14
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 14.21.3-150200.15.52.2
14.21.3-150200.15.52.2
nodejs14
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 14.21.3-150200.15.52.2
14.21.3-150200.15.52.2
nodejs14
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 14.21.3-150200.15.52.2
14.21.3-150200.15.52.2
nodejs14
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 14.21.3-150200.15.52.2
14.21.3-150200.15.52.2
nodejs14
SUSE:Manager Server 4.2
 before 14.21.3-150200.15.52.2
14.21.3-150200.15.52.2
nodejs14
SUSE:Enterprise Storage 7.1
 before 14.21.3-150200.15.52.2
14.21.3-150200.15.52.2
nodejs14
openSUSE:Leap 15.4
 before 14.21.3-150200.15.52.2
14.21.3-150200.15.52.2
nodejs12
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 12.22.12-150200.4.53.2
12.22.12-150200.4.53.2
nodejs12
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 12.22.12-150200.4.53.2
12.22.12-150200.4.53.2
nodejs12
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 12.22.12-150200.4.53.2
12.22.12-150200.4.53.2
nodejs12
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 12.22.12-150200.4.53.2
12.22.12-150200.4.53.2
nodejs12
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 12.22.12-150200.4.53.2
12.22.12-150200.4.53.2
nodejs12
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 12.22.12-150200.4.53.2
12.22.12-150200.4.53.2
nodejs12
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 12.22.12-150200.4.53.2
12.22.12-150200.4.53.2
nodejs12
SUSE:Manager Server 4.2
 before 12.22.12-150200.4.53.2
12.22.12-150200.4.53.2
nodejs12
SUSE:Enterprise Storage 7.1
 before 12.22.12-150200.4.53.2
12.22.12-150200.4.53.2
nodejs12
openSUSE:Leap 15.4
 before 12.22.12-150200.4.53.2
12.22.12-150200.4.53.2
nodejs
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu3
Show 7 moreShow less
12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.312.22.9~dfsg-1ubuntu3.412.22.9~dfsg-1ubuntu3.512.22.9~dfsg-1ubuntu3.612.22.9~dfsg-1ubuntu3.6+esm2
 None known
nodejs20
openSUSE:Tumbleweed
 before 20.8.1-1.1
20.8.1-1.1
nodejs-electron
openSUSE:Tumbleweed
 before 25.9.1-2.1
25.9.1-2.1

History

History
RecordedChangedSources
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-38552 is a high vulnerability (CVSS 7.5) in Nodejs Node, published October 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in nodejs 18.18.2-r0.

References

Show 85 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open