Every CVE Search/ Get API key

CVE-2023-39332

Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In...

9.8 CriticalFix available

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects.

This is distinct from CVE-2023-32004 which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.19%Up 2.1 points since Oct 18, 2023
90%50%10%1%

What each source reports

NVD Score used 9.8

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects.

This is distinct from CVE-2023-32004 which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
CVE-2023-39332
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
CVE List No score

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects.

This is distinct from CVE-2023-32004 which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
CVE-2023-39332
Updated
2026-11-02
EUVDEUVD-2023-43063 No score

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects.

This is distinct from CVE-2023-32004 which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
EUVD-2023-43063
Updated
2026-11-02
GitHub AdvisoriesGHSA-9hm3-chgj-45rm 9.8

Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In...

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects.

This is distinct from CVE-2023-32004 (report 2038134), which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer.

Impacts:

This vulnerability affects all users using the experimental permission model in Node.js 20.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
GHSA-9hm3-chgj-45rm
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2023-39332 9.8

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects.

This is distinct from CVE-2023-32004 which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
ALPINE-CVE-2023-39332
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVRHSA-2023:7205 9.8

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2023:7205
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVALSA-2023:7205 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • nodejs: permission model improperly protects against path traversal (CVE-2023-39331)
  • nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)
  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)
  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:7205
Updated
2026-11-02
OSVBIT-node-2023-39332 No score

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects.

This is distinct from CVE-2023-32004 which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
BIT-node-2023-39332
Updated
2026-11-02
OSVBIT-node-min-2023-39332 No score

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects.

This is distinct from CVE-2023-32004 which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
BIT-node-min-2023-39332
Updated
2026-11-02
OSV No score

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects.

This is distinct from CVE-2023-32004 which only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Record
CVE-2023-39332
Updated
2026-11-02
OSVopenSUSE-SU-2024:13337-1 No score

corepack20-20.8.1-1.1 on GA media

These are all security issues fixed in the corepack20-20.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13337-1
Updated
2026-11-02
OSVRLSA-2023:7205 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

  • nodejs: permission model improperly protects against path traversal (CVE-2023-39331)

  • nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)

  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)

  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)

  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:7205
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs-current
Alpine:v3.18
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.19
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.20
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.21
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.22
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.23
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.24
 before 20.8.1-r0
20.8.1-r0
nodejs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-docs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
Show 20 moreShow less
Affected packages
PackageAffectedFixed
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-nodemon
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.0.1-1.module_el8.9.0+3675+0258a6d9
3.0.1-1.module_el8.9.0+3675+0258a6d9
nodejs-packaging
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2021.06-4.module_el8.9.0+3684+11b9e959
2021.06-4.module_el8.9.0+3684+11b9e959
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2021.06-4.module_el8.9.0+3684+11b9e959
2021.06-4.module_el8.9.0+3684+11b9e959
npm
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9
1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9
node
Bitnami
 20.0.0 up to 20.8.0
20.8.0
node-min
Bitnami
 20.0.0 up to 20.8.0
20.8.0
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.0.1-1.module+el8.9.0+20473+c4e3d824
0:3.0.1-1.module+el8.9.0+20473+c4e3d824
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-4.module+el8.9.0+19519+e25b965a
0:2021.06-4.module+el8.9.0+19519+e25b965a
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-4.module+el8.9.0+19519+e25b965a
0:2021.06-4.module+el8.9.0+19519+e25b965a
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824
1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824
nodejs-nodemon
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:3.0.1-1.module+el8.8.0+1459+02651ab6
0:3.0.1-1.module+el8.8.0+1459+02651ab6
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-4.module+el8.7.0+1072+5b168780
0:2021.06-4.module+el8.7.0+1072+5b168780
nodejs20
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 20.8.1-1.1
20.8.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-39332 is a critical vulnerability (CVSS 9.8) in Nodejs Node, published October 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.19%, the 82nd percentile. Fixed in nodejs-current 20.8.1-r0.

References

Show 51 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open