Every CVE Search/ Get API key

CVE-2023-39333

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code....

5.3 MediumFix available

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

1.11%Up 1.1 points since Sep 8, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.3

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.

Record
CVE-2023-39333
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2023-43064 5.3

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.

Record
EUVD-2023-43064
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wj24-gwh6-mgh8 5.3

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code....

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.

Record
GHSA-wj24-gwh6-mgh8
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-94
Updated
2026-11-02
NVD 5.3

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.

Record
CVE-2023-39333
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-94
Updated
2026-11-02
OSVALPINE-CVE-2023-39333 5.3

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.

Record
ALPINE-CVE-2023-39333
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-03
OSVDEBIAN-CVE-2023-39333 5.3

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.

Record
DEBIAN-CVE-2023-39333
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 23 moreShow less
OSVRHSA-2023:5849 7.5

Red Hat Security Advisory: nodejs:18 security update

Record
RHSA-2023:5849
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2023:5869 7.5

Red Hat Security Advisory: nodejs:18 security update

Record
RHSA-2023:5869
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2023:7205 9.8

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2023:7205
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2023:5849 7.5

Important: nodejs:18 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)

  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)

  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:5849
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRLSA-2023:5869 7.5

Important: nodejs:18 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

A Rocky Enterprise Software Foundation Security Bulletin which addresses further details about this flaw is available in the References section.

  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)

  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)

  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:5869
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-39333 5.3

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.

Record
UBUNTU-CVE-2023-39333
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVALSA-2023:5849 No score

Important: nodejs:18 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)
  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:5849
Updated
2026-11-02
OSVALSA-2023:5869 No score

Important: nodejs:18 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

A AlmaLinux Security Bulletin which addresses further details about this flaw is available in the References section.

  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)
  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:5869
Updated
2026-11-02
OSVALSA-2023:7205 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  • nodejs: permission model improperly protects against path traversal (CVE-2023-39331)
  • nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)
  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)
  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)
  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:7205
Updated
2026-11-02
OSVBIT-node-2023-39333 No score

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.

Record
BIT-node-2023-39333
Updated
2026-11-02
OSVBIT-node-min-2023-39333 No score

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.

Record
BIT-node-min-2023-39333
Updated
2026-11-02
OSVCLSA-2025-1762361695 No score

nodejs: Fix of CVE-2023-39333

  • CVE-2023-39333: fix maliciously crafted export names injection of JavaScript code
Record
CLSA-2025-1762361695
Updated
2026-11-02
OSVCLSA-2026-1772617597 No score

nodejs: Fix of 2 CVEs

  • CVE-2025-22150: fix issue where undici used Math.random() to choose boundary for multipart/form-data request, now uses secure random number generator
  • CVE-2023-39333: fix maliciously crafted export names injection of JavaScript code
  • Run full Node.js tests in %check
  • Fix comment typo in spec
Record
CLSA-2026-1772617597
Updated
2026-11-02
OSV No score

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.

Record
CVE-2023-39333
Updated
2026-11-02
OSVMGASA-2023-0299 No score

Updated nodejs packages fix security vulnerabilities

This is a security release. The following CVEs are fixed in this release:

CVE-2023-44487: nghttp2 Security Release (High) CVE-2023-45143: undici Security Release (High) CVE-2023-38552: Integrity checks according to policies can be circumvented (Medium) CVE-2023-39333: Code injection via WebAssembly export names (Low)

More detailed information on each of the vulnerabilities can be found in October 2023 Security Releases blog post.

Record
MGASA-2023-0299
Updated
2026-11-02
OSVopenSUSE-SU-2024:13337-1 No score

corepack20-20.8.1-1.1 on GA media

These are all security issues fixed in the corepack20-20.8.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13337-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13340-1 No score

nodejs-electron-25.9.1-2.1 on GA media

These are all security issues fixed in the nodejs-electron-25.9.1-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13340-1
Updated
2026-11-02
OSVRLSA-2023:7205 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)

  • nodejs: permission model improperly protects against path traversal (CVE-2023-39331)

  • nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)

  • nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)

  • nodejs: code injection via WebAssembly export names (CVE-2023-39333)

  • node-undici: cookie leakage (CVE-2023-45143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:7205
Updated
2026-11-02
OSVSUSE-SU-2023:4132-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • Update to version 18.18.2
  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
  • CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
Record
SUSE-SU-2023:4132-1
Updated
2026-11-02
OSVSUSE-SU-2023:4133-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • Update to version 18.18.2
  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
  • CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
Record
SUSE-SU-2023:4133-1
Updated
2026-11-02
OSVSUSE-SU-2023:4150-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • Update to version 18.18.2
  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
  • CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
Record
SUSE-SU-2023:4150-1
Updated
2026-11-02
OSVSUSE-SU-2023:4155-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • Update to version 18.18.2
  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
  • CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
Record
SUSE-SU-2023:4155-1
Updated
2026-11-02
OSVSUSE-SU-2023:4207-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • Update to version 18.18.2
  • CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
  • CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)
  • CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)
  • CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)
Record
SUSE-SU-2023:4207-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.17
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.18
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.19
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.20
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.21
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.22
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.23
 before 18.18.2-r0
18.18.2-r0
nodejs
Alpine:v3.24
 before 18.18.2-r0
18.18.2-r0
nodejs-current
Alpine:v3.18
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.19
 before 20.8.1-r0
20.8.1-r0
Show 111 moreShow less
Affected packages
PackageAffectedFixed
nodejs-current
Alpine:v3.20
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.21
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.22
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.23
 before 20.8.1-r0
20.8.1-r0
nodejs-current
Alpine:v3.24
 before 20.8.1-r0
20.8.1-r0
nodejs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
1:18.18.2-2.module_el9.2.0+43+3ebc9e20
nodejs-devel
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
1:18.18.2-2.module_el9.2.0+43+3ebc9e20
nodejs-docs
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
1:18.18.2-2.module_el9.2.0+43+3ebc9e20
nodejs-full-i18n
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
1:18.18.2-2.module_el9.2.0+43+3ebc9e20
nodejs-nodemon
AlmaLinux:9
From an advisory covering 4 CVEs
 before 3.0.1-1.module_el9.2.0+36+853e48f5
3.0.1-1.module_el9.2.0+36+853e48f5
nodejs-packaging
AlmaLinux:9
From an advisory covering 4 CVEs
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
nodejs-packaging-bundler
AlmaLinux:9
From an advisory covering 4 CVEs
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
npm
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20
1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20
nodejs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
1:18.18.2-1.module_el8.8.0+3652+0e111ba0
nodejs-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
1:18.18.2-1.module_el8.8.0+3652+0e111ba0
nodejs-docs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
1:18.18.2-1.module_el8.8.0+3652+0e111ba0
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:18.18.2-1.module_el8.8.0+3652+0e111ba0
1:18.18.2-1.module_el8.8.0+3652+0e111ba0
nodejs-nodemon
AlmaLinux:8
From an advisory covering 4 CVEs
 before 3.0.1-1.module_el8.8.0+3613+1ed8c91d
3.0.1-1.module_el8.8.0+3613+1ed8c91d
nodejs-packaging
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
npm
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0
1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0
nodejs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-docs
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-nodemon
AlmaLinux:8
From an advisory covering 6 CVEs
 before 3.0.1-1.module_el8.9.0+3675+0258a6d9
3.0.1-1.module_el8.9.0+3675+0258a6d9
nodejs-packaging
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2021.06-4.module_el8.9.0+3684+11b9e959
2021.06-4.module_el8.9.0+3684+11b9e959
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2021.06-4.module_el8.9.0+3684+11b9e959
2021.06-4.module_el8.9.0+3684+11b9e959
npm
AlmaLinux:8
From an advisory covering 6 CVEs
 before 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9
1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9
node
Bitnami
 before 18.18.2, 19.0.0 up to 20.8.1
18.18.220.8.1
node-min
Bitnami
 before 18.18.2, 19.0.0 up to 20.8.1
18.18.220.8.1
nodejs
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-3.el9_2.tuxcare.els14
1:16.20.2-3.el9_2.tuxcare.els14
nodejs-devel
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-3.el9_2.tuxcare.els14
1:16.20.2-3.el9_2.tuxcare.els14
nodejs-docs
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-3.el9_2.tuxcare.els14
1:16.20.2-3.el9_2.tuxcare.els14
nodejs-full-i18n
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-3.el9_2.tuxcare.els14
1:16.20.2-3.el9_2.tuxcare.els14
nodejs-libs
TuxCare:AlmaLinux:9.2
 before 1:16.20.2-3.el9_2.tuxcare.els14
1:16.20.2-3.el9_2.tuxcare.els14
npm
TuxCare:AlmaLinux:9.2
 before 1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els14
1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els14
v8-devel
TuxCare:AlmaLinux:9.2
 before 2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els14
2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els14
nodejs
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els9
1:16.20.2-8.el9_6.tuxcare.els9
nodejs-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els9
1:16.20.2-8.el9_6.tuxcare.els9
nodejs-docs
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els9
1:16.20.2-8.el9_6.tuxcare.els9
nodejs-full-i18n
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els9
1:16.20.2-8.el9_6.tuxcare.els9
nodejs-libs
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els9
1:16.20.2-8.el9_6.tuxcare.els9
npm
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els9
1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els9
v8-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els9
2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els9
nodejs
Debian:12
 before 18.19.0+dfsg-6~deb12u1, plus listed versions
18.13.0+dfsg1-118.13.0+dfsg1-1.118.19.0+dfsg-118.19.0+dfsg-218.19.0+dfsg-318.19.0+dfsg-418.19.0+dfsg-5
18.19.0+dfsg-6~deb12u1
nodejs
Debian:13
 before 18.13.0+dfsg1-1.1
18.13.0+dfsg1-1.1
nodejs
Debian:14
 before 18.13.0+dfsg1-1.1
18.13.0+dfsg1-1.1
nodejs
Debian:12
From an advisory covering 12 CVEs
 before 18.19.0+dfsg-6~deb12u1, plus listed versions
18.13.0+dfsg1-118.13.0+dfsg1-1.118.19.0+dfsg-118.19.0+dfsg-218.19.0+dfsg-318.19.0+dfsg-418.19.0+dfsg-5
18.19.0+dfsg-6~deb12u1
nodejs
Mageia:9
From an advisory covering 4 CVEs
 before 18.18.2-1.mga9
18.18.2-1.mga9
yarnpkg
Mageia:9
From an advisory covering 4 CVEs
 before 1.22.19-14.mga9
1.22.19-14.mga9
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0
0:3.0.1-1.module+el9.2.0.z+19753+58118bc0
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 1:9.8.1-1.18.18.2.2.module+el9.2.0.z+20408+7cb5fda5
1:9.8.1-1.18.18.2.2.module+el9.2.0.z+20408+7cb5fda5
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:18.18.2-1.module+el8.8.0+20407+c11d40bd
1:18.18.2-1.module+el8.8.0+20407+c11d40bd
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.8.0+19757+8ca87034
0:3.0.1-1.module+el8.8.0+19757+8ca87034
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 1:9.8.1-1.18.18.2.1.module+el8.8.0+20407+c11d40bd
1:9.8.1-1.18.18.2.1.module+el8.8.0+20407+c11d40bd
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:3.0.1-1.module+el8.9.0+20473+c4e3d824
0:3.0.1-1.module+el8.9.0+20473+c4e3d824
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-4.module+el8.9.0+19519+e25b965a
0:2021.06-4.module+el8.9.0+19519+e25b965a
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2021.06-4.module+el8.9.0+19519+e25b965a
0:2021.06-4.module+el8.9.0+19519+e25b965a
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824
1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40017+f0db1785
0:3.0.1-1.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40018+a011993d
0:3.0.1-1.module+el9.7.0+40018+a011993d
nodejs-nodemon
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el9.7.0+40022+9ecc286c
0:3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-packaging
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:2021.06-4.module+el9.7.0+40022+9ecc286c
0:2021.06-4.module+el9.7.0+40022+9ecc286c
nodejs-packaging
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2
0:2021.06-4.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:2021.06-4.module+el9.7.0+40018+a011993d
0:2021.06-4.module+el9.7.0+40018+a011993d
nodejs-packaging
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:2021.06-4.module+el9.7.0+40017+f0db1785
0:2021.06-4.module+el9.7.0+40017+f0db1785
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-packaging
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:2021.06-4.module+el8.10.0+1989+e60144d9
0:2021.06-4.module+el8.10.0+1989+e60144d9
nodejs-packaging
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:2021.06-4.module+el8.10.0+1988+437f3d23
0:2021.06-4.module+el8.10.0+1988+437f3d23
nodejs-packaging
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:2021.06-4.module+el8.10.0+1824+532140ee
0:2021.06-4.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:3.0.1-1.module+el8.8.0+1459+02651ab6
0:3.0.1-1.module+el8.8.0+1459+02651ab6
nodejs-packaging
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2021.06-4.module+el8.7.0+1072+5b168780
0:2021.06-4.module+el8.7.0+1072+5b168780
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 4 CVEs
 before 18.18.2-8.15.1
18.18.2-8.15.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
From an advisory covering 4 CVEs
 before 18.18.2-150400.9.15.1
18.18.2-150400.9.15.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5
From an advisory covering 4 CVEs
 before 18.18.2-150400.9.15.1
18.18.2-150400.9.15.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 4 CVEs
 before 16.20.2-8.36.1
16.20.2-8.36.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
From an advisory covering 4 CVEs
 before 16.20.2-150400.3.27.2
16.20.2-150400.3.27.2
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
From an advisory covering 4 CVEs
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 4 CVEs
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs16
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 4 CVEs
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs16
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 4 CVEs
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs16
SUSE:Manager Server 4.2
From an advisory covering 4 CVEs
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs16
SUSE:Enterprise Storage 7.1
From an advisory covering 4 CVEs
 before 16.20.2-150300.7.30.1
16.20.2-150300.7.30.1
nodejs
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu3
Show 7 moreShow less
12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.312.22.9~dfsg-1ubuntu3.412.22.9~dfsg-1ubuntu3.512.22.9~dfsg-1ubuntu3.612.22.9~dfsg-1ubuntu3.6+esm2
 None known
nodejs20
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 20.8.1-1.1
20.8.1-1.1
nodejs-electron
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 25.9.1-2.1
25.9.1-2.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-39333 is a medium vulnerability (CVSS 5.3) in Nodejs Node, published October 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in nodejs 18.18.2-r0.

References

Show 74 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open