Every CVE Search/ Get API key

CVE-2023-23919

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...

7.5 HighFix available

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.21%Up 1.3 points since Feb 24, 2023
90%50%10%1%

What each source reports

NVD Score used 7.5

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Record
CVE-2023-23919
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-310
Updated
2026-11-02
CVE List 7.5

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Record
CVE-2023-23919
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-310
Updated
2026-11-02
EUVDEUVD-2023-28001 7.5

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Record
EUVD-2023-28001
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mfq6-mjjx-mp7f 7.5

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in...

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Record
GHSA-mfq6-mjjx-mp7f
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALPINE-CVE-2023-23919 7.5

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Record
ALPINE-CVE-2023-23919
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-13684 7.5

CVE-2023-23919 affecting package nodejs for versions less than 16.19.1-1

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Record
AZL-13684
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 22 moreShow less
OSVBELL-CVE-2023-23919 7.5

CVE-2023-23919 does not affect BellSoft software

Record
BELL-CVE-2023-23919
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Record
CVE-2023-23919
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-310
Updated
2026-11-02
OSVDEBIAN-CVE-2023-23919 7.5

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Record
DEBIAN-CVE-2023-23919
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2023:1582 8.6

Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Record
RHSA-2023:1582
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2023:1583 7.5

Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

Record
RHSA-2023:1583
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2023:2654 8.6

Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

Record
RHSA-2023:2654
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2023:2654 8.6

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:2654
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-23919 7.5

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Record
UBUNTU-CVE-2023-23919
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2023:1582 No score

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:1582
Updated
2026-11-02
OSVALSA-2023:1583 No score

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:1583
Updated
2026-11-02
OSVALSA-2023:2654 No score

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (18.14.2).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)
  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)
  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)
  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)
  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)
  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:2654
Updated
2026-11-02
OSVBIT-node-2023-23919 No score

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Record
BIT-node-2023-23919
Updated
2026-11-02
OSVBIT-node-min-2023-23919 No score

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Record
BIT-node-min-2023-23919
Updated
2026-11-02
OSVopenSUSE-SU-2024:12725-1 No score

corepack18-18.14.2-1.1 on GA media

These are all security issues fixed in the corepack18-18.14.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12725-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12726-1 No score

corepack19-19.7.0-1.1 on GA media

These are all security issues fixed in the corepack19-19.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12726-1
Updated
2026-11-02
OSVRLSA-2023:1582 No score

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.19.1).

Security Fix(es):

  • glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  • c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

  • http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  • Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  • Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

  • Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  • Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  • Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:1582
Updated
2026-11-02
OSVSUSE-SU-2023:0608-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to LTS version 16.19.1:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).

Bug fixes:

  • Workaround for failing openssl-nodejs test (bsc#1205568).
Record
SUSE-SU-2023:0608-1
Updated
2026-11-02
OSVSUSE-SU-2023:0609-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to LTS version 16.19.1:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).

Bug fixes:

  • Workaround for failing openssl-nodejs test (bsc#1205568).
Record
SUSE-SU-2023:0609-1
Updated
2026-11-02
OSVSUSE-SU-2023:0673-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to LTS version 16.19.1:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).

Bug fixes:

  • Workaround for failing openssl-nodejs test (bsc#1205568).
Record
SUSE-SU-2023:0673-1
Updated
2026-11-02
OSVSUSE-SU-2023:0715-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to NodeJS 18.14.2 LTS:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).
Record
SUSE-SU-2023:0715-1
Updated
2026-11-02
OSVSUSE-SU-2023:0738-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to NodeJS 18.14.2 LTS:

  • CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481).
  • CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library (bsc#1208483).
  • CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487).
  • CVE-2023-23936: Fixed protection against CRLF injection in host headers inside fetch API (bsc#1208485).
  • CVE-2023-24807: Fixed possible Regular Expression Denial of Service (ReDoS) via Headers.set() and Headers.append() methods (bsc#1208413).
Record
SUSE-SU-2023:0738-1
Updated
2026-11-02
OSVUSN-6672-1 No score

nodejs vulnerabilities

Morgan Jones discovered that Node.js incorrectly handled certain inputs that leads to false positive errors during some cryptographic operations. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.10. (CVE-2023-23919)

It was discovered that Node.js incorrectly handled certain inputs leaded to a untrusted search path vulnerability. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform a privilege escalation. (CVE-2023-23920)

Matt Caswell discovered that Node.js incorrectly handled certain inputs with specially crafted ASN.1 object identifiers or data containing them. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-2650)

Record
USN-6672-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
Alpine:v3.15
 before 16.19.1-r0
16.19.1-r0
nodejs
Alpine:v3.16
 before 16.19.1-r0
16.19.1-r0
nodejs
Alpine:v3.17
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.18
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.19
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.20
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.21
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.22
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.23
 before 18.14.1-r0
18.14.1-r0
nodejs
Alpine:v3.24
 before 18.14.1-r0
18.14.1-r0
Show 81 moreShow less
Affected packages
PackageAffectedFixed
nodejs
AlmaLinux:8
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-devel
AlmaLinux:8
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-docs
AlmaLinux:8
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-full-i18n
AlmaLinux:8
 before 1:16.19.1-1.module_el8.7.0+3496+a59a3324
1:16.19.1-1.module_el8.7.0+3496+a59a3324
nodejs-nodemon
AlmaLinux:8
 before 2.0.20-3.module_el8.7.0+3496+a59a3324
2.0.20-3.module_el8.7.0+3496+a59a3324
nodejs-packaging
AlmaLinux:8
 before 25-1.module_el8.5.0+2605+45d748af
25-1.module_el8.5.0+2605+45d748af
npm
AlmaLinux:8
 before 1:8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324
1:8.19.3-1.16.19.1.1.module_el8.7.0+3496+a59a3324
nodejs
AlmaLinux:8
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-devel
AlmaLinux:8
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-docs
AlmaLinux:8
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-full-i18n
AlmaLinux:8
 before 1:18.14.2-2.module_el8.7.0+3497+c65299e7
1:18.14.2-2.module_el8.7.0+3497+c65299e7
nodejs-nodemon
AlmaLinux:8
 before 2.0.20-2.module_el8.7.0+3497+c65299e7
2.0.20-2.module_el8.7.0+3497+c65299e7
nodejs-packaging
AlmaLinux:8
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
nodejs-packaging-bundler
AlmaLinux:8
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
npm
AlmaLinux:8
 before 1:9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7
1:9.5.0-1.18.14.2.2.module_el8.7.0+3497+c65299e7
nodejs
AlmaLinux:9
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-devel
AlmaLinux:9
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-docs
AlmaLinux:9
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-full-i18n
AlmaLinux:9
 before 1:18.14.2-2.module_el9.2.0+29+de583a0b
1:18.14.2-2.module_el9.2.0+29+de583a0b
nodejs-nodemon
AlmaLinux:9
 before 2.0.20-2.module_el9.2.0+29+de583a0b
2.0.20-2.module_el9.2.0+29+de583a0b
nodejs-packaging
AlmaLinux:9
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
nodejs-packaging-bundler
AlmaLinux:9
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
npm
AlmaLinux:9
 before 1:9.5.0-1.18.14.2.2.module_el9.2.0+29+de583a0b
1:9.5.0-1.18.14.2.2.module_el9.2.0+29+de583a0b
nodejs
Azure Linux:2
 before 16.19.1-1
16.19.1-1
node
Bitnami
 14.0.0 up to 14.21.3, 16.0.0 up to 16.19.1, 18.0.0 up to 18.14.1, 19.0.0 up to 19.2.0
14.21.316.19.118.14.119.2.0
node-min
Bitnami
 14.0.0 up to 14.21.3, 16.0.0 up to 16.19.1, 18.0.0 up to 18.14.1, 19.0.0 up to 19.2.0
14.21.316.19.118.14.119.2.0
nodejs
Debian:12
 before 18.19.0+dfsg-6~deb12u1, plus listed versions
18.13.0+dfsg1-118.13.0+dfsg1-1.118.19.0+dfsg-118.19.0+dfsg-218.19.0+dfsg-318.19.0+dfsg-418.19.0+dfsg-5
18.19.0+dfsg-6~deb12u1
nodejs
Debian:13
 before 18.13.0+dfsg1-1.1
18.13.0+dfsg1-1.1
nodejs
Debian:14
 before 18.13.0+dfsg1-1.1
18.13.0+dfsg1-1.1
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:16.19.1-1.module+el8.7.0+18373+704f5cef
1:16.19.1-1.module+el8.7.0+18373+704f5cef
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.20-3.module+el8.7.0+18373+704f5cef
0:2.0.20-3.module+el8.7.0+18373+704f5cef
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:25-1.module+el8.5.0+10992+fac5fe06
0:25-1.module+el8.5.0+10992+fac5fe06
npm
Red Hat:enterprise_linux:8::appstream
 before 1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef
1:8.19.3-1.16.19.1.1.module+el8.7.0+18373+704f5cef
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:18.14.2-2.module+el8.7.0+18445+9493b6ea
1:18.14.2-2.module+el8.7.0+18445+9493b6ea
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.20-2.module+el8.7.0+18445+9493b6ea
0:2.0.20-2.module+el8.7.0+18445+9493b6ea
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
npm
Red Hat:enterprise_linux:8::appstream
 before 1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea
1:9.5.0-1.18.14.2.2.module+el8.7.0+18445+9493b6ea
nodejs
Red Hat:enterprise_linux:9::appstream
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-devel
Red Hat:enterprise_linux:9::appstream
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-docs
Red Hat:enterprise_linux:9::appstream
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
 before 1:18.14.2-2.module+el9.2.0.z+18497+a402347c
1:18.14.2-2.module+el9.2.0.z+18497+a402347c
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
 before 0:2.0.20-2.module+el9.2.0.z+18497+a402347c
0:2.0.20-2.module+el9.2.0.z+18497+a402347c
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
npm
Red Hat:enterprise_linux:9::appstream
 before 1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c
1:9.5.0-1.18.14.2.2.module+el9.2.0.z+18497+a402347c
nodejs
Rocky Linux:8
 before 1:16.19.1-1.module+el8.7.0+1178+d52dba78
1:16.19.1-1.module+el8.7.0+1178+d52dba78
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.20-3.module+el8.7.0+1178+d52dba78
0:2.0.20-3.module+el8.7.0+1178+d52dba78
nodejs-packaging
Rocky Linux:8
 before 0:25-1.module+el8.6.0+1046+80feca58
0:25-1.module+el8.6.0+1046+80feca58
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2
0:2021.06-4.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.7.0+40017+f0db1785
0:2021.06-4.module+el9.7.0+40017+f0db1785
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.7.0+40018+a011993d
0:2021.06-4.module+el9.7.0+40018+a011993d
nodejs-packaging
Rocky Linux:9
 before 0:2021.06-4.module+el9.7.0+40022+9ecc286c
0:2021.06-4.module+el9.7.0+40022+9ecc286c
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
 before 16.19.1-150400.3.15.1
16.19.1-150400.3.15.1
nodejs16
openSUSE:Leap 15.4
 before 16.19.1-150400.3.15.1
16.19.1-150400.3.15.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 16.19.1-8.24.1
16.19.1-8.24.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Manager Server 4.2
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs16
SUSE:Enterprise Storage 7.1
 before 16.19.1-150300.7.18.1
16.19.1-150300.7.18.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 18.14.2-8.6.2
18.14.2-8.6.2
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
 before 18.14.2-150400.9.6.2
18.14.2-150400.9.6.2
nodejs18
openSUSE:Leap 15.4
 before 18.14.2-150400.9.6.2
18.14.2-150400.9.6.2
nodejs
Ubuntu:20.04:LTS
 before 10.19.0~dfsg-3ubuntu1.5, plus listed versions
10.15.2~dfsg-2ubuntu110.17.0~dfsg-2ubuntu410.17.0~dfsg-2ubuntu610.19.0~dfsg-3ubuntu110.19.0~dfsg-3ubuntu1.110.19.0~dfsg-3ubuntu1.210.19.0~dfsg-3ubuntu1.3
10.19.0~dfsg-3ubuntu1.5
nodejs
Ubuntu:22.04:LTS
 before 12.22.9~dfsg-1ubuntu3.4, plus listed versions
12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu312.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.3
12.22.9~dfsg-1ubuntu3.4
nodejs18
openSUSE:Tumbleweed
 before 18.14.2-1.1
18.14.2-1.1
nodejs19
openSUSE:Tumbleweed
 before 19.7.0-1.1
19.7.0-1.1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-23919 is a high vulnerability (CVSS 7.5) in Nodejs Node, published February 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.21%, the 82nd percentile. Fixed in nodejs 16.19.1-r0.

References

Show 82 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open