Every CVE Search/ Get API key

CVE-2023-30588

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...

5.3 MediumFix available

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

1.16%Up 1.1 points since Nov 29, 2023
90%50%10%1%

What each source reports

NVD Score used 5.3

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Record
CVE-2023-30588
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
CVE List No score

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Record
CVE-2023-30588
Updated
2026-11-03
EUVDEUVD-2023-34969 No score

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Record
EUVD-2023-34969
Updated
2026-11-03
GitHub AdvisoriesGHSA-g526-x7vj-cfv6 5.3

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate...

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Record
GHSA-g526-x7vj-cfv6
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2023-30588 5.3

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Record
DEBIAN-CVE-2023-30588
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
OSVRHSA-2023:4330 7.5

Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

Record
RHSA-2023:4330
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 23 moreShow less
OSVRHSA-2023:4331 7.5

Red Hat Security Advisory: nodejs security, bug fix, and enhancement update

Record
RHSA-2023:4331
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2023:4536 7.5

Red Hat Security Advisory: nodejs:18 security, bug fix, and enhancement update

Record
RHSA-2023:4536
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2023:4537 7.5

Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Record
RHSA-2023:4537
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2023:5361 8.8

Red Hat Security Advisory: nodejs:16 security, bug fix, and enhancement update

Record
RHSA-2023:5361
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:5533 8.8

Red Hat Security Advisory: nodejs security, bug fix, and enhancement update

Record
RHSA-2023:5533
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2023:4536 7.5

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The package has been upgraded to a later upstream version: nodejs (18.16.1). (BZ#2223630, BZ#2223631, BZ#2223632, BZ#2223633, BZ#2223635, BZ#2223642)

Security Fix(es):

  • nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)

  • nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)

  • nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)

  • nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:18/nodejs: Don't assume FIPS is disabled by default [rhel-8] (BZ#2223639)
Record
RLSA-2023:4536
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-30588 5.3

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Record
UBUNTU-CVE-2023-30588
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2023:4330 No score

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The package has been upgraded to a later upstream version: nodejs (18). (BZ#2223314, BZ#2223316, BZ#2223318, BZ#2223319, BZ#2223320, BZ#2223354)

Security Fix(es):

  • nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
  • nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
  • nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
  • nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:4330
Updated
2026-11-02
OSVALSA-2023:4331 No score

Moderate: nodejs security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The package has been upgraded to a later upstream version: nodejs (16.20.1). (BZ#2223334, BZ#2223336, BZ#2223338, BZ#2223340, BZ#2223342, BZ#2223344)

Security Fix(es):

  • nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
  • nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
  • nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
  • nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:4331
Updated
2026-11-02
OSVALSA-2023:4536 No score

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The package has been upgraded to a later upstream version: nodejs (18.16.1). (BZ#2223630, BZ#2223631, BZ#2223632, BZ#2223633, BZ#2223635, BZ#2223642)

Security Fix(es):

  • nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
  • nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
  • nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
  • nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • nodejs:18/nodejs: Don't assume FIPS is disabled by default [almalinux-8] (BZ#2223639)
Record
ALSA-2023:4536
Updated
2026-11-02
OSVALSA-2023:4537 No score

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The package has been upgraded to a later upstream version: nodejs (16.20.1). (BZ#2223678, BZ#2223680, BZ#2223682, BZ#2223684, BZ#2223686, BZ#2223688)

Security Fix(es):

  • nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
  • nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
  • nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
  • nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2023:4537
Updated
2026-11-02
OSVBIT-node-2023-30588 No score

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Record
BIT-node-2023-30588
Updated
2026-11-02
OSVBIT-node-min-2023-30588 No score

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Record
BIT-node-min-2023-30588
Updated
2026-11-02
OSV No score

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Record
CVE-2023-30588
Updated
2026-11-04
OSVMGASA-2023-0226 No score

Updated nodejs packages fix security vulnerability

Current nodejs 14 branch in Mageia 8 is end of life and there are no more security updates.

This release allows to move to the new nodejs 18 LTS branch and fixes the following CVEs CVE-2023-30581: mainModule.proto Bypass Experimental Policy Mechanism (High) CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium) CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium) CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium) OpenSSL Security Releases OpenSSL security advisory 28th March. OpenSSL security advisory 20th April. OpenSSL security advisory 30th May c-ares vulnerabilities: GHSA-9g78-jv2r-p7vc GHSA-8r8p-23f3-64c2 GHSA-54xr-f67r-4pc4 GHSA-x6mf-cxr9-8q6v

Record
MGASA-2023-0226
Updated
2026-11-02
OSVopenSUSE-SU-2024:13021-1 No score

corepack20-20.3.1-1.1 on GA media

These are all security issues fixed in the corepack20-20.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13021-1
Updated
2026-11-02
OSVRLSA-2023:4537 No score

Moderate: nodejs:16 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The package has been upgraded to a later upstream version: nodejs (16.20.1). (BZ#2223678, BZ#2223680, BZ#2223682, BZ#2223684, BZ#2223686, BZ#2223688)

Security Fix(es):

  • nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)

  • nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)

  • nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)

  • nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2023:4537
Updated
2026-11-02
OSVSUSE-SU-2023:2655-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to version 16.20.1:

  • CVE-2023-30581: Fixed mainModule.proto Bypass Experimental Policy Mechanism (bsc#1212574).
  • CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (bsc#1212579).
  • CVE-2023-30588: Fixed process interuption due to invalid Public Key information in x509 certificates (bsc#1212581).
  • CVE-2023-30589: Fixed HTTP Request Smuggling via empty headers separated by CR (bsc#1212582).
  • CVE-2023-30590: Fixed DiffieHellman key generation after setting a private key (bsc#1212583).
  • CVE-2023-31124: Fixed cross compilation issue with AutoTools that does not set CARES_RANDOM_FILE (bsc#1211607).
  • CVE-2023-31130: Fixed buffer underwrite problem in ares_inet_net_pton() (bsc#1211606).
  • CVE-2023-31147: Fixed insufficient randomness in generation of DNS query IDs (bsc#1211605).
  • CVE-2023-32067: Fixed denial-of-service via 0-byte UDP payload (bsc#1211604).

Bug fixes:

  • Increased the default timeout on unit tests from 2 to 20 minutes. This seems to have lead to build failures on some platforms, like s390x in Factory. (bsc#1211407)
Record
SUSE-SU-2023:2655-1
Updated
2026-11-02
OSVSUSE-SU-2023:2662-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to version 18.16.1:

  • CVE-2023-30581: Fixed mainModule.proto Bypass Experimental Policy Mechanism (bsc#1212574).
  • CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (bsc#1212579).
  • CVE-2023-30588: Fixed process interuption due to invalid Public Key information in x509 certificates (bsc#1212581).
  • CVE-2023-30589: Fixed HTTP Request Smuggling via empty headers separated by CR (bsc#1212582).
  • CVE-2023-30590: Fixed DiffieHellman key generation after setting a private key (bsc#1212583).
  • CVE-2023-31124: Fixed cross compilation issue with AutoTools that does not set CARES_RANDOM_FILE (bsc#1211607).
  • CVE-2023-31130: Fixed buffer underwrite problem in ares_inet_net_pton() (bsc#1211606).
  • CVE-2023-31147: Fixed insufficient randomness in generation of DNS query IDs (bsc#1211605).
  • CVE-2023-32067: Fixed denial-of-service via 0-byte UDP payload (bsc#1211604).
  • CVE-2022-25881: Fixed a Regular Expression Denial of Service (bsc#1208744).

Bug fixes:

  • Increased the default timeout on unit tests from 2 to 20 minutes. This seems to have lead to build failures on some platforms, like s390x in Factory. (bsc#1211407)
Record
SUSE-SU-2023:2662-1
Updated
2026-11-02
OSVSUSE-SU-2023:2663-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to version 16.20.1:

  • CVE-2023-30581: Fixed mainModule.proto Bypass Experimental Policy Mechanism (bsc#1212574).
  • CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (bsc#1212579).
  • CVE-2023-30588: Fixed process interuption due to invalid Public Key information in x509 certificates (bsc#1212581).
  • CVE-2023-30589: Fixed HTTP Request Smuggling via empty headers separated by CR (bsc#1212582).
  • CVE-2023-30590: Fixed DiffieHellman key generation after setting a private key (bsc#1212583).
  • CVE-2023-31124: Fixed cross compilation issue with AutoTools that does not set CARES_RANDOM_FILE (bsc#1211607).
  • CVE-2023-31130: Fixed buffer underwrite problem in ares_inet_net_pton() (bsc#1211606).
  • CVE-2023-31147: Fixed insufficient randomness in generation of DNS query IDs (bsc#1211605).
  • CVE-2023-32067: Fixed denial-of-service via 0-byte UDP payload (bsc#1211604).

Bug fixes:

  • Increased the default timeout on unit tests from 2 to 20 minutes. This seems to have lead to build failures on some platforms, like s390x in Factory. (bsc#1211407)
Record
SUSE-SU-2023:2663-1
Updated
2026-11-02
OSVSUSE-SU-2023:2669-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

Update to version 18.16.1:

  • CVE-2023-30581: Fixed mainModule.proto Bypass Experimental Policy Mechanism (bsc#1212574).
  • CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (bsc#1212579).
  • CVE-2023-30588: Fixed process interuption due to invalid Public Key information in x509 certificates (bsc#1212581).
  • CVE-2023-30589: Fixed HTTP Request Smuggling via empty headers separated by CR (bsc#1212582).
  • CVE-2023-30590: Fixed DiffieHellman key generation after setting a private key (bsc#1212583).
  • CVE-2023-31124: Fixed cross compilation issue with AutoTools that does not set CARES_RANDOM_FILE (bsc#1211607).
  • CVE-2023-31130: Fixed buffer underwrite problem in ares_inet_net_pton() (bsc#1211606).
  • CVE-2023-31147: Fixed insufficient randomness in generation of DNS query IDs (bsc#1211605).
  • CVE-2023-32067: Fixed denial-of-service via 0-byte UDP payload (bsc#1211604).
  • CVE-2022-25881: Fixed a Regular Expression Denial of Service (bsc#1208744).

Bug fixes:

  • Increased the default timeout on unit tests from 2 to 20 minutes. This seems to have lead to build failures on some platforms, like s390x in Factory. (bsc#1211407)
Record
SUSE-SU-2023:2669-1
Updated
2026-11-02
OSVSUSE-SU-2023:2861-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

Update to version 16.20.1:

  • CVE-2023-30581: Fixed mainModule.proto Bypass Experimental Policy Mechanism (bsc#1212574).
  • CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (bsc#1212579).
  • CVE-2023-30588: Fixed process interuption due to invalid Public Key information in x509 certificates (bsc#1212581).
  • CVE-2023-30589: Fixed HTTP Request Smuggling via empty headers separated by CR (bsc#1212582).
  • CVE-2023-30590: Fixed DiffieHellman key generation after setting a private key (bsc#1212583).
  • CVE-2023-31124: Fixed cross compilation issue with AutoTools that does not set CARES_RANDOM_FILE (bsc#1211607).
  • CVE-2023-31130: Fixed buffer underwrite problem in ares_inet_net_pton() (bsc#1211606).
  • CVE-2023-31147: Fixed insufficient randomness in generation of DNS query IDs (bsc#1211605).
  • CVE-2023-32067: Fixed denial-of-service via 0-byte UDP payload (bsc#1211604).

Bug fixes:

  • Increased the default timeout on unit tests from 2 to 20 minutes. This seems to have lead to build failures on some platforms, like s390x in Factory. (bsc#1211407)
Record
SUSE-SU-2023:2861-1
Updated
2026-11-02
OSVUSN-6735-1 No score

nodejs vulnerabilities

It was discovered that Node.js incorrectly handled the use of invalid public keys while creating an x509 certificate. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.10. (CVE-2023-30588)

It was discovered that Node.js incorrectly handled the use of CRLF sequences to delimit HTTP requests. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain unauthorised access. This issue only affected Ubuntu 23.10. (CVE-2023-30589)

It was discovered that Node.js incorrectly described the generateKeys() function in the documentation. This inconsistency could possibly lead to security issues in applications that use these APIs. (CVE-2023-30590)

Record
USN-6735-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
AlmaLinux:9
 before 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-devel
AlmaLinux:9
 before 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-docs
AlmaLinux:9
 before 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-full-i18n
AlmaLinux:9
 before 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-nodemon
AlmaLinux:9
 before 2.0.20-2.module_el9.2.0+29+de583a0b
2.0.20-2.module_el9.2.0+29+de583a0b
nodejs-packaging
AlmaLinux:9
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
nodejs-packaging-bundler
AlmaLinux:9
 before 2021.06-4.module_el9.1.0+13+d9a595ea
2021.06-4.module_el9.1.0+13+d9a595ea
npm
AlmaLinux:9
 before 1:9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8e
1:9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8e
nodejs
AlmaLinux:9
 before 1:16.20.1-1.el9_2
1:16.20.1-1.el9_2
nodejs-docs
AlmaLinux:9
 before 1:16.20.1-1.el9_2
1:16.20.1-1.el9_2
Show 103 moreShow less
Affected packages
PackageAffectedFixed
nodejs-full-i18n
AlmaLinux:9
 before 1:16.20.1-1.el9_2
1:16.20.1-1.el9_2
nodejs-libs
AlmaLinux:9
 before 1:16.20.1-1.el9_2
1:16.20.1-1.el9_2
npm
AlmaLinux:9
 before 1:8.19.4-1.16.20.1.1.el9_2
1:8.19.4-1.16.20.1.1.el9_2
nodejs
AlmaLinux:8
 before 1:18.16.1-1.module_el8.8.0+3595+0818e803
1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-devel
AlmaLinux:8
 before 1:18.16.1-1.module_el8.8.0+3595+0818e803
1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-docs
AlmaLinux:8
 before 1:18.16.1-1.module_el8.8.0+3595+0818e803
1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-full-i18n
AlmaLinux:8
 before 1:18.16.1-1.module_el8.8.0+3595+0818e803
1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-nodemon
AlmaLinux:8
 before 2.0.20-2.module_el8.8.0+3587+ee652244
2.0.20-2.module_el8.8.0+3587+ee652244
nodejs-packaging
AlmaLinux:8
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
nodejs-packaging-bundler
AlmaLinux:8
 before 2021.06-4.module_el8.7.0+3343+ea2b7901
2021.06-4.module_el8.7.0+3343+ea2b7901
npm
AlmaLinux:8
 before 1:9.5.1-1.18.16.1.1.module_el8.8.0+3595+0818e803
1:9.5.1-1.18.16.1.1.module_el8.8.0+3595+0818e803
nodejs
AlmaLinux:8
 before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
1:16.20.1-1.module_el8.8.0+3594+e74fe53f
nodejs-devel
AlmaLinux:8
 before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
1:16.20.1-1.module_el8.8.0+3594+e74fe53f
nodejs-docs
AlmaLinux:8
 before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
1:16.20.1-1.module_el8.8.0+3594+e74fe53f
nodejs-full-i18n
AlmaLinux:8
 before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
1:16.20.1-1.module_el8.8.0+3594+e74fe53f
nodejs-nodemon
AlmaLinux:8
 before 2.0.20-3.module_el8.8.0+3586+d4fc0b72
2.0.20-3.module_el8.8.0+3586+d4fc0b72
nodejs-packaging
AlmaLinux:8
 before 25-1.module_el8.5.0+2605+45d748af
25-1.module_el8.5.0+2605+45d748af
npm
AlmaLinux:8
 before 1:8.19.4-1.16.20.1.1.module_el8.8.0+3594+e74fe53f
1:8.19.4-1.16.20.1.1.module_el8.8.0+3594+e74fe53f
node
Bitnami
 16.0.0 up to 16.20.1, 18.0.0 up to 18.16.1, 20.0.0 up to 20.3.1
16.20.118.16.120.3.1
node-min
Bitnami
 16.0.0 up to 16.20.1, 18.0.0 up to 18.16.1, 20.0.0 up to 20.3.1
16.20.118.16.120.3.1
nodejs
Debian:12
 before 18.19.0+dfsg-6~deb12u1, plus listed versions
18.13.0+dfsg1-118.13.0+dfsg1-1.118.19.0+dfsg-118.19.0+dfsg-218.19.0+dfsg-318.19.0+dfsg-418.19.0+dfsg-5
18.19.0+dfsg-6~deb12u1
nodejs
Debian:13
 before 18.13.0+dfsg1-1.1
18.13.0+dfsg1-1.1
nodejs
Debian:14
 before 18.13.0+dfsg1-1.1
18.13.0+dfsg1-1.1
nodejs
Mageia:8
 before 18.16.1-1.mga8
18.16.1-1.mga8
nodejs
Red Hat:enterprise_linux:9::appstream
 before 1:18.16.1-1.module+el9.2.0.z+19424+78951f07
1:18.16.1-1.module+el9.2.0.z+19424+78951f07
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:18.16.1-1.module+el9.2.0.z+19424+78951f07
1:18.16.1-1.module+el9.2.0.z+19424+78951f07
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:18.16.1-1.module+el9.2.0.z+19424+78951f07
1:18.16.1-1.module+el9.2.0.z+19424+78951f07
nodejs-devel
Red Hat:enterprise_linux:9::appstream
 before 1:18.16.1-1.module+el9.2.0.z+19424+78951f07
1:18.16.1-1.module+el9.2.0.z+19424+78951f07
nodejs-docs
Red Hat:enterprise_linux:9::appstream
 before 1:18.16.1-1.module+el9.2.0.z+19424+78951f07
1:18.16.1-1.module+el9.2.0.z+19424+78951f07
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
 before 1:18.16.1-1.module+el9.2.0.z+19424+78951f07
1:18.16.1-1.module+el9.2.0.z+19424+78951f07
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
 before 0:2.0.20-2.module+el9.2.0.z+18497+a402347c
0:2.0.20-2.module+el9.2.0.z+18497+a402347c
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
 before 0:2021.06-4.module+el9.1.0+15718+e52ec601
0:2021.06-4.module+el9.1.0+15718+e52ec601
npm
Red Hat:enterprise_linux:9::appstream
 before 1:9.5.1-1.18.16.1.1.module+el9.2.0.z+19424+78951f07
1:9.5.1-1.18.16.1.1.module+el9.2.0.z+19424+78951f07
nodejs
Red Hat:enterprise_linux:9::appstream
 before 1:16.20.1-1.el9_2
1:16.20.1-1.el9_2
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:16.20.1-1.el9_2
1:16.20.1-1.el9_2
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:16.20.1-1.el9_2
1:16.20.1-1.el9_2
nodejs-docs
Red Hat:enterprise_linux:9::appstream
 before 1:16.20.1-1.el9_2
1:16.20.1-1.el9_2
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
 before 1:16.20.1-1.el9_2
1:16.20.1-1.el9_2
nodejs-libs
Red Hat:enterprise_linux:9::appstream
 before 1:16.20.1-1.el9_2
1:16.20.1-1.el9_2
nodejs-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:16.20.1-1.el9_2
1:16.20.1-1.el9_2
npm
Red Hat:enterprise_linux:9::appstream
 before 1:8.19.4-1.16.20.1.1.el9_2
1:8.19.4-1.16.20.1.1.el9_2
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:18.16.1-1.module+el8.8.0+19438+94e84959
1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:18.16.1-1.module+el8.8.0+19438+94e84959
1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:18.16.1-1.module+el8.8.0+19438+94e84959
1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:18.16.1-1.module+el8.8.0+19438+94e84959
1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:18.16.1-1.module+el8.8.0+19438+94e84959
1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:18.16.1-1.module+el8.8.0+19438+94e84959
1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.20-2.module+el8.8.0+18432+27f188ac
0:2.0.20-2.module+el8.8.0+18432+27f188ac
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
 before 0:2021.06-4.module+el8.7.0+15582+19c314fa
0:2021.06-4.module+el8.7.0+15582+19c314fa
npm
Red Hat:enterprise_linux:8::appstream
 before 1:9.5.1-1.18.16.1.1.module+el8.8.0+19438+94e84959
1:9.5.1-1.18.16.1.1.module+el8.8.0+19438+94e84959
nodejs
Red Hat:enterprise_linux:8::appstream
 before 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
nodejs-devel
Red Hat:enterprise_linux:8::appstream
 before 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
nodejs-docs
Red Hat:enterprise_linux:8::appstream
 before 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
 before 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
1:16.20.1-1.module+el8.8.0+19440+ee8dbee5
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
 before 0:2.0.20-3.module+el8.8.0+19038+6f60344f
0:2.0.20-3.module+el8.8.0+19038+6f60344f
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
 before 0:25-1.module+el8.5.0+10992+fac5fe06
0:25-1.module+el8.5.0+10992+fac5fe06
npm
Red Hat:enterprise_linux:8::appstream
 before 1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5
1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5
nodejs
Red Hat:rhel_eus:8.6::appstream
 before 1:16.20.2-2.module+el8.6.0+19897+9590a839
1:16.20.2-2.module+el8.6.0+19897+9590a839
nodejs-debuginfo
Red Hat:rhel_eus:8.6::appstream
 before 1:16.20.2-2.module+el8.6.0+19897+9590a839
1:16.20.2-2.module+el8.6.0+19897+9590a839
nodejs-debugsource
Red Hat:rhel_eus:8.6::appstream
 before 1:16.20.2-2.module+el8.6.0+19897+9590a839
1:16.20.2-2.module+el8.6.0+19897+9590a839
nodejs-devel
Red Hat:rhel_eus:8.6::appstream
 before 1:16.20.2-2.module+el8.6.0+19897+9590a839
1:16.20.2-2.module+el8.6.0+19897+9590a839
nodejs-docs
Red Hat:rhel_eus:8.6::appstream
 before 1:16.20.2-2.module+el8.6.0+19897+9590a839
1:16.20.2-2.module+el8.6.0+19897+9590a839
nodejs-full-i18n
Red Hat:rhel_eus:8.6::appstream
 before 1:16.20.2-2.module+el8.6.0+19897+9590a839
1:16.20.2-2.module+el8.6.0+19897+9590a839
nodejs-nodemon
Red Hat:rhel_eus:8.6::appstream
 before 0:3.0.1-1.module+el8.6.0+19765+366b9144
0:3.0.1-1.module+el8.6.0+19765+366b9144
nodejs-packaging
Red Hat:rhel_eus:8.6::appstream
 before 0:26-1.module+el8.6.0+19856+c0c87259
0:26-1.module+el8.6.0+19856+c0c87259
npm
Red Hat:rhel_eus:8.6::appstream
 before 1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839
1:8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839
nodejs
Red Hat:rhel_eus:9.0::appstream
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-debuginfo
Red Hat:rhel_eus:9.0::appstream
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-debugsource
Red Hat:rhel_eus:9.0::appstream
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-docs
Red Hat:rhel_eus:9.0::appstream
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-full-i18n
Red Hat:rhel_eus:9.0::appstream
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-libs
Red Hat:rhel_eus:9.0::appstream
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
nodejs-libs-debuginfo
Red Hat:rhel_eus:9.0::appstream
 before 1:16.20.2-1.el9_0
1:16.20.2-1.el9_0
npm
Red Hat:rhel_eus:9.0::appstream
 before 1:8.19.4-1.16.20.2.1.el9_0
1:8.19.4-1.16.20.2.1.el9_0
nodejs
Rocky Linux:8
 before 1:18.16.1-1.module+el8.8.0+1413+a47876c7
1:18.16.1-1.module+el8.8.0+1413+a47876c7
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.20-2.module+el8.7.0+1177+510ae886
0:2.0.20-2.module+el8.7.0+1177+510ae886
nodejs-packaging
Rocky Linux:8
 before 0:2021.06-4.module+el8.7.0+1072+5b168780
0:2021.06-4.module+el8.7.0+1072+5b168780
nodejs-nodemon
Rocky Linux:8
 before 0:2.0.20-3.module+el8.7.0+1178+d52dba78
0:2.0.20-3.module+el8.7.0+1178+d52dba78
nodejs-packaging
Rocky Linux:8
 before 0:25-1.module+el8.7.0+1108+49363b0d
0:25-1.module+el8.7.0+1108+49363b0d
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 16.20.1-8.30.1
16.20.1-8.30.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 18.16.1-8.9.1
18.16.1-8.9.1
nodejs16
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
 before 16.20.1-150400.3.21.1
16.20.1-150400.3.21.1
nodejs16
openSUSE:Leap 15.4
 before 16.20.1-150400.3.21.1
16.20.1-150400.3.21.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 15 SP4
 before 18.16.1-150400.9.9.1
18.16.1-150400.9.9.1
nodejs18
SUSE:Linux Enterprise Module for Web and Scripting 15 SP5
 before 18.16.1-150400.9.9.1
18.16.1-150400.9.9.1
nodejs18
openSUSE:Leap 15.4
 before 18.16.1-150400.9.9.1
18.16.1-150400.9.9.1
nodejs18
openSUSE:Leap 15.5
 before 18.16.1-150400.9.9.1
18.16.1-150400.9.9.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 16.20.1-150300.7.24.2
16.20.1-150300.7.24.2
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 16.20.1-150300.7.24.2
16.20.1-150300.7.24.2
nodejs16
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 16.20.1-150300.7.24.2
16.20.1-150300.7.24.2
nodejs16
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 16.20.1-150300.7.24.2
16.20.1-150300.7.24.2
nodejs16
SUSE:Manager Server 4.2
 before 16.20.1-150300.7.24.2
16.20.1-150300.7.24.2
nodejs16
SUSE:Enterprise Storage 7.1
 before 16.20.1-150300.7.24.2
16.20.1-150300.7.24.2
nodejs
Ubuntu:Pro:14.04:LTS
 before 0.10.25~dfsg2-2ubuntu1.2+esm2, plus listed versions
0.10.15~dfsg1-40.10.21~dfsg1-10.10.22~dfsg1-20.10.23~dfsg1-10.10.23~dfsg1-2
Show 6 moreShow less
0.10.23~dfsg1-30.10.24~dfsg1-10.10.25~dfsg2-20.10.25~dfsg2-2ubuntu10.10.25~dfsg2-2ubuntu1.20.10.25~dfsg2-2ubuntu1.2+esm1
0.10.25~dfsg2-2ubuntu1.2+esm2
nodejs
Ubuntu:Pro:16.04:LTS
 before 4.2.6~dfsg-1ubuntu4.2+esm3, plus listed versions
0.10.25~dfsg2-2ubuntu14.2.2~dfsg-14.2.3~dfsg-14.2.4~dfsg-1ubuntu14.2.4~dfsg-2
Show 6 moreShow less
4.2.6~dfsg-1ubuntu14.2.6~dfsg-1ubuntu44.2.6~dfsg-1ubuntu4.14.2.6~dfsg-1ubuntu4.24.2.6~dfsg-1ubuntu4.2+esm14.2.6~dfsg-1ubuntu4.2+esm2
4.2.6~dfsg-1ubuntu4.2+esm3
nodejs
Ubuntu:Pro:18.04:LTS
 before 8.10.0~dfsg-2ubuntu0.4+esm5, plus listed versions
6.11.4~dfsg-1ubuntu16.11.4~dfsg-1ubuntu26.12.0~dfsg-1ubuntu16.12.0~dfsg-2ubuntu16.12.0~dfsg-2ubuntu2
Show 8 moreShow less
8.10.0~dfsg-28.10.0~dfsg-2ubuntu0.28.10.0~dfsg-2ubuntu0.38.10.0~dfsg-2ubuntu0.48.10.0~dfsg-2ubuntu0.4+esm18.10.0~dfsg-2ubuntu0.4+esm28.10.0~dfsg-2ubuntu0.4+esm38.10.0~dfsg-2ubuntu0.4+esm4
8.10.0~dfsg-2ubuntu0.4+esm5
nodejs
Ubuntu:20.04:LTS
 before 10.19.0~dfsg-3ubuntu1.6, plus listed versions
10.15.2~dfsg-2ubuntu110.17.0~dfsg-2ubuntu410.17.0~dfsg-2ubuntu610.19.0~dfsg-3ubuntu110.19.0~dfsg-3ubuntu1.110.19.0~dfsg-3ubuntu1.210.19.0~dfsg-3ubuntu1.310.19.0~dfsg-3ubuntu1.5
10.19.0~dfsg-3ubuntu1.6
nodejs
Ubuntu:22.04:LTS
 before 12.22.9~dfsg-1ubuntu3.5, plus listed versions
12.22.5~dfsg-5ubuntu112.22.7~dfsg-2ubuntu112.22.7~dfsg-2ubuntu312.22.9~dfsg-1ubuntu212.22.9~dfsg-1ubuntu3
Show 4 moreShow less
12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.212.22.9~dfsg-1ubuntu3.312.22.9~dfsg-1ubuntu3.4
12.22.9~dfsg-1ubuntu3.5
nodejs20
openSUSE:Tumbleweed
 before 20.3.1-1.1
20.3.1-1.1

History

History
RecordedChangedSources
factsNVD, OSV
affectedCVE List, EUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-30588 is a medium vulnerability (CVSS 5.3) in Nodejs Node, published June 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in nodejs 1:18.16.1-1.module_el9.2.0+31+cbae0c8e.

References

Show 130 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open