Every CVE Search/ Get API key

CVE-2023-39331

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit...

7.7 HighFix available

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.51%Up 1.5 points since Oct 18, 2023
90%50%10%1%

What each source reports

CVE List Score used 7.7

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
CVE-2023-39331
CVSS 3.0
7.7 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
EUVDEUVD-2023-43062 7.7

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
EUVD-2023-43062
CVSS 3.0
7.7 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-7xrv-q25v-f95m 7.7

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit...

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
GHSA-7xrv-q25v-f95m
CVSS 3.0
7.7 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 7.5

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
CVE-2023-39331
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.0
7.7 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2023-39331 7.5

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
ALPINE-CVE-2023-39331
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSV 7.7

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
CVE-2023-39331
CVSS 3.0
7.7 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2023:7205 9.8

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2023:7205
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2023:7205 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • nodejs: permission model improperly protects against path traversal (CVE-2023-39331)
  • nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)
  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)
  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:7205
Updated
2026-11-02
OSVBIT-node-2023-39331 No score

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
BIT-node-2023-39331
Updated
2026-11-02
OSVBIT-node-min-2023-39331 No score

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
BIT-node-min-2023-39331
Updated
2026-11-02
OSVopenSUSE-SU-2024:13337-1 No score

corepack20-20.8.1-1.1 on GA media

These are all security issues fixed in the corepack20-20.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13337-1
Updated
2026-11-02
OSVRLSA-2023:7205 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

  • nodejs: permission model improperly protects against path traversal (CVE-2023-39331)

  • nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)

  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)

  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)

  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:7205
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs-current
Alpine:v3.18
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.19
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.20
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.21
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.22
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.23
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.24
 before 20.8.1-r0
20.8.1-r0
nodejs
AlmaLinux:8
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-devel
AlmaLinux:8
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-docs
AlmaLinux:8
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
Show 20 moreShow less
Affected packages
PackageAffectedFixed
nodejs-full-i18n
AlmaLinux:8
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-nodemon
AlmaLinux:8
 before 3.0.1-1.module_el8.9.0+3675+0258a6d9
3.0.1-1.module_el8.9.0+3675+0258a6d9
nodejs-packaging
AlmaLinux:8
 before 2021.06-4.module_el8.9.0+3684+11b9e959
2021.06-4.module_el8.9.0+3684+11b9e959
nodejs-packaging-bundler
AlmaLinux:8
 before 2021.06-4.module_el8.9.0+3684+11b9e959
2021.06-4.module_el8.9.0+3684+11b9e959
npm
AlmaLinux:8
 before 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9
1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9
node
Bitnami
 20.0.0 up to 20.8.1
20.8.1
node-min
Bitnami
 20.0.0 up to 20.8.1
20.8.1
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.1-1.module+el8.9.0+20473+c4e3d824
0:3.0.1-1.module+el8.9.0+20473+c4e3d824
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.9.0+19519+e25b965a
0:2021.06-4.module+el8.9.0+19519+e25b965a
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.9.0+19519+e25b965a
0:2021.06-4.module+el8.9.0+19519+e25b965a
npm
Red Hat:enterprise_linux:8::appstream
 before 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824
1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824
nodejs-nodemon
Rocky Linux:8
 before 0:3.0.1-1.module+el8.8.0+1459+02651ab6
0:3.0.1-1.module+el8.8.0+1459+02651ab6
nodejs-packaging
Rocky Linux:8
 before 0:2021.06-4.module+el8.7.0+1072+5b168780
0:2021.06-4.module+el8.7.0+1072+5b168780
nodejs20
openSUSE:Tumbleweed
 before 20.8.1-1.1
20.8.1-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-39331 is a high vulnerability (CVSS 7.7) in Nodejs Node, published October 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in nodejs-current 20.8.1-r0.

References

Show 51 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open