{"id":"CVE-2023-39331","aliases":["ALPINE-CVE-2023-39331","ALSA-2023:7205","BIT-node-2023-39331","BIT-node-min-2023-39331","EUVD-2023-43062","GHSA-7xrv-q25v-f95m","RHSA-2023:7205","RLSA-2023:7205","openSUSE-SU-2024:13337-1"],"status":"published","title":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit...","description":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","severity":{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01508,"percentile":0.74582,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-10-18T03:55:18Z","modified":"2026-11-03T06:32:43Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["20.8.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["20.8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3684+11b9e959"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3684+11b9e959"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.8.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.8.0+1459+02651ab6"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+1072+5b168780"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-1.1"}]}],"bundled":6}],"products":[{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"}],"references":[{"url":"https://hackerone.com/reports/2092852","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231116-0009/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39331","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG"},{"url":"https://security.netapp.com/advisory/ntap-20231116-0009"},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002"},{"url":"https://github.com/advisories/GHSA-7xrv-q25v-f95m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-39331","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7205","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38552","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39331","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39332","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39333","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45143","tags":["report"]},{"url":"https://bugzilla.redhat.com/2242803","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244104","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244413","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244414","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244415","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244418","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7205.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39331.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244418","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7205.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38552","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39331","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39332","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39333","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39333","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45143","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2023:7205","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45143","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-39331","description":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T03:55:18.506Z","modified":"2025-11-03T21:49:16.116Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:33.462059Z"}],"euvd":[{"id":"EUVD-2023-43062","description":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T03:55:18Z","modified":"2025-11-03T21:49:16Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-7xrv-q25v-f95m","title":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit...","description":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T06:30:30Z","modified":"2025-11-04T00:31:44Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:28.99549Z"}],"nvd":[{"id":"CVE-2023-39331","description":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T04:15:11.257Z","modified":"2026-06-17T06:12:03.057Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:39.058878Z"}],"osv":[{"id":"ALPINE-CVE-2023-39331","description":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T04:15:11.257Z","modified":"2026-11-03T06:32:43.324934418Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2023-39331","description":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T03:55:18.506Z","modified":"2026-10-28T02:30:53.542180154Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"RHSA-2023:7205","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-10-22T01:55:14Z","modified":"2026-10-15T10:06:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"ALSA-2023:7205","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* nodejs: permission model improperly protects against path traversal (CVE-2023-39331)\n* nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.297751752Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"BIT-node-2023-39331","description":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-03-06T10:59:16.754Z","modified":"2026-09-08T08:48:17.625607028Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2023-39331","description":"A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-12-16T13:56:45.521Z","modified":"2026-09-08T08:48:17.385159426Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"openSUSE-SU-2024:13337-1","title":"corepack20-20.8.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:33.89781Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2023:7205","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* nodejs: permission model improperly protects against path traversal (CVE-2023-39331)\n\n* nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)\n\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-11-28T22:43:02.525343Z","modified":"2026-02-04T09:00:08.753615Z","updated_at":"2026-11-02T15:53:24.63379Z"}]}}