{"id":"CVE-2023-39332","aliases":["ALPINE-CVE-2023-39332","ALSA-2023:7205","BIT-node-2023-39332","BIT-node-min-2023-39332","EUVD-2023-43063","GHSA-9hm3-chgj-45rm","RHSA-2023:7205","RLSA-2023:7205","openSUSE-SU-2024:13337-1"],"status":"published","title":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In...","description":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.\r\n\r\nThis is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.\r\n\r\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02185,"percentile":0.82629,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-10-18T03:55:18Z","modified":"2026-11-03T06:32:02Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["20.8.0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["20.8.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3684+11b9e959"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3684+11b9e959"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.8.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"20.0.0"},{"fixed":"20.8.0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.8.0+1459+02651ab6"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+1072+5b168780"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-1.1"}]}],"bundled":6}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"}],"references":[{"url":"https://hackerone.com/reports/2199818","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","tags":["x_transferred","Mailing List","discussion","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231116-0009/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39332","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG"},{"url":"https://security.netapp.com/advisory/ntap-20231116-0009"},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002"},{"url":"https://github.com/advisories/GHSA-9hm3-chgj-45rm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-39332","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7205","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38552","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39331","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39332","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39333","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45143","tags":["report"]},{"url":"https://bugzilla.redhat.com/2242803","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244104","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244413","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244414","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244415","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244418","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7205.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39332.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244418","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7205.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38552","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39331","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39331","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39332","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39333","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39333","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45143","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2023:7205","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45143","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-39332","description":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.\r\n\r\nThis is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.\r\n\r\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T03:55:18.469Z","modified":"2025-11-03T21:49:17.572Z","updated_at":"2026-11-02T14:35:33.138994Z"}],"euvd":[{"id":"EUVD-2023-43063","description":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.\r\n\r\nThis is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.\r\n\r\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T03:55:18Z","modified":"2025-11-03T21:49:17Z","updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-9hm3-chgj-45rm","title":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In...","description":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.\n\nThis is distinct from CVE-2023-32004 ([report 2038134](https://hackerone.com/reports/2038134)), which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.\n\nImpacts:\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T06:30:30Z","modified":"2025-11-04T00:30:40Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:25.970519Z"}],"nvd":[{"id":"CVE-2023-39332","description":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.\r\n\r\nThis is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.\r\n\r\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T04:15:11.33Z","modified":"2026-06-17T06:12:03.19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:39.058878Z"}],"osv":[{"id":"ALPINE-CVE-2023-39332","description":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.\r\n\r\nThis is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.\r\n\r\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T04:15:11.33Z","modified":"2026-11-03T06:32:02.336571731Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"RHSA-2023:7205","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-10-22T01:55:14Z","modified":"2026-10-15T10:06:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"ALSA-2023:7205","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* nodejs: permission model improperly protects against path traversal (CVE-2023-39331)\n* nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.297751752Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"BIT-node-2023-39332","description":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.\r\n\r\nThis is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.\r\n\r\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-03-06T10:59:07.902Z","modified":"2026-09-08T08:48:17.63029446Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2023-39332","description":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.\r\n\r\nThis is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.\r\n\r\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2024-12-16T13:56:35.222Z","modified":"2026-09-08T08:46:59.744054904Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CVE-2023-39332","description":"Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.\r\n\r\nThis is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.\r\n\r\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","status":"published","published":"2023-10-18T03:55:18.469Z","modified":"2026-10-28T02:31:07.907408561Z","updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"openSUSE-SU-2024:13337-1","title":"corepack20-20.8.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:33.89781Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2023:7205","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* nodejs: permission model improperly protects against path traversal (CVE-2023-39331)\n\n* nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)\n\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-11-28T22:43:02.525343Z","modified":"2026-02-04T09:00:08.753615Z","updated_at":"2026-11-02T15:53:24.63379Z"}]}}