{"id":"CVE-2023-39333","aliases":["ALPINE-CVE-2023-39333","ALSA-2023:5849","ALSA-2023:5869","ALSA-2023:7205","BIT-node-2023-39333","BIT-node-min-2023-39333","CLSA-2025-1762361695","CLSA-2026-1772617597","DEBIAN-CVE-2023-39333","DSA-5589-1","EUVD-2023-43064","GHSA-wj24-gwh6-mgh8","MGASA-2023-0299","RHSA-2023:5849","RHSA-2023:5869","RHSA-2023:7205","RLSA-2023:5849","RLSA-2023:5869","RLSA-2023:7205","SUSE-SU-2023:4132-1","SUSE-SU-2023:4133-1","SUSE-SU-2023:4150-1","SUSE-SU-2023:4155-1","SUSE-SU-2023:4207-1","UBUNTU-CVE-2023-39333","openSUSE-SU-2024:13337-1","openSUSE-SU-2024:13340-1"],"status":"published","title":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code....","description":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.\n\nThis vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.01107,"percentile":0.66282,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2023-10-18T00:00:00Z","modified":"2026-11-03T06:32:02Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["18.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["20.8.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["18.18.2","20.8.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["18.18.2","20.8.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","fixed_in":["1:16.20.2-3.el9_2.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","fixed_in":["1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","fixed_in":["2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els14"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nodejs","fixed_in":["18.19.0+dfsg-6~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["18.13.0+dfsg1-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["18.13.0+dfsg1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module_el9.2.0+43+3ebc9e20"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module_el9.2.0+43+3ebc9e20"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module_el9.2.0+43+3ebc9e20"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module_el9.2.0+43+3ebc9e20"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el9.2.0+36+853e48f5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el9.1.0+13+d9a595ea"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module_el8.8.0+3652+0e111ba0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module_el8.8.0+3652+0e111ba0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module_el8.8.0+3652+0e111ba0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module_el8.8.0+3652+0e111ba0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.8.0+3613+1ed8c91d"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.7.0+3343+ea2b7901"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3684+11b9e959"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.9.0+3684+11b9e959"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9"}]}],"bundled":6},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.18.2"},{"introduced":"19.0.0"},{"fixed":"20.8.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.18.2"},{"introduced":"19.0.0"},{"fixed":"20.8.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-3.el9_2.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-3.el9_2.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-3.el9_2.tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"v8-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els9"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.0+dfsg-6~deb12u1"}]}],"versions":["18.13.0+dfsg1-1","18.13.0+dfsg1-1.1","18.19.0+dfsg-1","18.19.0+dfsg-2","18.19.0+dfsg-3","18.19.0+dfsg-4","18.19.0+dfsg-5"]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.13.0+dfsg1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.13.0+dfsg1-1.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.19.0+dfsg-6~deb12u1"}]}],"versions":["18.13.0+dfsg1-1","18.13.0+dfsg1-1.1","18.19.0+dfsg-1","18.19.0+dfsg-2","18.19.0+dfsg-3","18.19.0+dfsg-4","18.19.0+dfsg-5"],"bundled":12},{"source":"osv","ecosystem":"Mageia:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-1.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.19-14.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.2.0.z+19753+58118bc0"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.1.0+15718+e52ec601"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.8.1-1.18.18.2.2.module+el9.2.0.z+20408+7cb5fda5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.18.2-1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.8.0+19757+8ca87034"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+15582+19c314fa"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.8.1-1.18.18.2.1.module+el8.8.0+20407+c11d40bd"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.8.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+19519+e25b965a"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40017+f0db1785"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40018+a011993d"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.7.0+40022+9ecc286c"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40022+9ecc286c"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40025+0e0cf6b2"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40018+a011993d"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.7.0+40017+f0db1785"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1989+e60144d9"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1988+437f3d23"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1824+532140ee"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.8.0+1459+02651ab6"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.7.0+1072+5b168780"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-8.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-150400.9.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.18.2-150400.9.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-8.36.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150400.3.27.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"nodejs16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.20.2-150300.7.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.8.1-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs-electron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.9.1-2.1"}]}],"bundled":3}],"products":[{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"nodejs"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/october-2023-security-releases","tags":["web","article"]},{"url":"https://security.netapp.com/advisory/ntap-20240808-0004/","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241004-0006/","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39333","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240808-0004"},{"url":"https://security.netapp.com/advisory/ntap-20241004-0006"},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002"},{"url":"https://github.com/advisories/GHSA-wj24-gwh6-mgh8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-39333","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5849","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38552","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39333","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45143","tags":["report"]},{"url":"https://bugzilla.redhat.com/2242803","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244104","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244415","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244418","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-5849.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5869","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-5869.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7205","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39331","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39332","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244413","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244414","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7205.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1762361695.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1772617597.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-39333","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0299.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32403","tags":["report"]},{"url":"https://github.com/nodejs/node/releases/tag/v18.18.2","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v18.18.1","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244418","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5849.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38552","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39333","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45143","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5869.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244414","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7205.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39331","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39331","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39332","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:5849","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:5869","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:7205","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234132-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216190","tags":["report"]},{"url":"https://bugzilla.suse.com/1216205","tags":["report"]},{"url":"https://bugzilla.suse.com/1216272","tags":["report"]},{"url":"https://bugzilla.suse.com/1216273","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45143","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234133-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234150-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234155-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234207-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-39333","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/october-2023-security-releases#code-injection-via-webassembly-export-names-low---cve-2023-39333","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/eaf9083cf1e43bd897ac8244dcc0f4e3500150ca","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39332","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-39333","description":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.\n\nThis vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.","status":"published","published":"2024-09-07T16:00:36.005Z","modified":"2025-11-03T21:49:19.026Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:33.138994Z"}],"euvd":[{"id":"EUVD-2023-43064","description":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.\n\nThis vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.","status":"published","published":"2024-09-07T16:00:36Z","modified":"2025-11-03T21:49:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-wj24-gwh6-mgh8","title":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code....","description":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.\n\nThis vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.","status":"published","published":"2024-09-07T18:30:23Z","modified":"2025-11-04T00:31:23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:04:27.827902Z"}],"nvd":[{"id":"CVE-2023-39333","description":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.\n\nThis vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.","status":"published","published":"2024-09-07T16:15:02.287Z","modified":"2026-06-17T06:12:03.327Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:09:19.052418Z"}],"osv":[{"id":"ALPINE-CVE-2023-39333","description":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.\n\nThis vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.","status":"published","published":"2024-09-07T16:15:02.287Z","modified":"2026-11-03T06:32:02.068710553Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"DEBIAN-CVE-2023-39333","description":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.  This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.","status":"published","published":"2024-09-07T16:15:02.287Z","modified":"2026-10-26T18:02:41.15960663Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"RHSA-2023:5849","title":"Red Hat Security Advisory: nodejs:18 security update","status":"published","published":"2024-10-22T01:46:18Z","modified":"2026-10-15T10:05:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:5869","title":"Red Hat Security Advisory: nodejs:18 security update","status":"published","published":"2024-10-22T01:46:40Z","modified":"2026-10-15T10:05:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:7205","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2024-10-22T01:55:14Z","modified":"2026-10-15T10:06:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RLSA-2023:5849","title":"Important: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-12-04T09:05:01.515036Z","modified":"2025-12-05T10:02:58.788613Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"RLSA-2023:5869","title":"Important: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\nA Rocky Enterprise Software Foundation Security Bulletin which addresses further details about this flaw is available in the References section.\n\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-12-04T09:03:04.71689Z","modified":"2025-12-05T10:19:43.557305Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-39333","description":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.","status":"published","published":"2024-09-07T16:15:00Z","modified":"2026-04-22T14:10:02.939286Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"ALSA-2023:5849","title":"Important: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-10-18T00:00:00Z","modified":"2026-10-29T11:30:59.028596121Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:5869","title":"Important: nodejs:18 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\nA AlmaLinux Security Bulletin which addresses further details about this flaw is available in the References section.\n\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-10-18T00:00:00Z","modified":"2026-10-29T11:02:19.308971662Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:7205","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n* nodejs: permission model improperly protects against path traversal (CVE-2023-39331)\n* nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.297751752Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"BIT-node-2023-39333","description":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.\n\nThis vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.","status":"published","published":"2024-09-10T07:16:15.926Z","modified":"2025-11-06T13:25:46.476Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2023-39333","description":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.\n\nThis vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.","status":"published","published":"2024-12-16T13:56:23.528Z","modified":"2025-11-06T13:25:46.476Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2025-1762361695","title":"nodejs: Fix of CVE-2023-39333","description":"- CVE-2023-39333: fix maliciously crafted export names injection of JavaScript\n  code","status":"published","published":"2025-11-05T16:54:59Z","modified":"2026-06-01T00:31:14.799616601Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1772617597","title":"nodejs: Fix of 2 CVEs","description":"- CVE-2025-22150: fix issue where undici used Math.random() to choose boundary\n  for multipart/form-data request, now uses secure random number generator\n- CVE-2023-39333: fix maliciously crafted export names injection of JavaScript\n  code\n- Run full Node.js tests in %check\n- Fix comment typo in spec","status":"published","published":"2026-03-04T09:46:41Z","modified":"2026-10-21T10:45:46.560208412Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CVE-2023-39333","description":"Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.\n\nThis vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.","status":"published","published":"2024-09-07T16:15:02Z","modified":"2026-04-16T04:33:44.647738931Z","updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"DSA-5589-1","title":"nodejs - security update","status":"published","published":"2023-12-27T00:00:00Z","modified":"2026-03-09T02:10:57.589968Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0299","title":"Updated nodejs packages fix security vulnerabilities","description":"This is a security release. The following CVEs are fixed in this\nrelease:\n\nCVE-2023-44487: nghttp2 Security Release (High)\nCVE-2023-45143: undici Security Release (High)\nCVE-2023-38552: Integrity checks according to policies can be\ncircumvented (Medium)\nCVE-2023-39333: Code injection via WebAssembly export names (Low)\n\nMore detailed information on each of the vulnerabilities can be found in\nOctober 2023 Security Releases blog post.\n","status":"published","published":"2023-10-22T21:04:51Z","modified":"2026-04-16T04:41:39.870706596Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13337-1","title":"corepack20-20.8.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:32:33.89781Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13340-1","title":"nodejs-electron-25.9.1-2.1 on GA media","description":"These are all security issues fixed in the nodejs-electron-25.9.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:15:05.213821Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2023:7205","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* nodejs: permission model improperly protects against path traversal (CVE-2023-39331)\n\n* nodejs: path traversal through path stored in Uint8Array (CVE-2023-39332)\n\n* nodejs: integrity checks according to policies can be circumvented (CVE-2023-38552)\n\n* nodejs: code injection via WebAssembly export names (CVE-2023-39333)\n\n* node-undici: cookie leakage (CVE-2023-45143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-11-28T22:43:02.525343Z","modified":"2026-02-04T09:00:08.753615Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:4132-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- Update to version 18.18.2\n- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)\n- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)\n- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)\n- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)\n","status":"published","published":"2023-10-19T10:02:49Z","modified":"2026-02-04T02:54:22.816663Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4133-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- Update to version 18.18.2\n- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)\n- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)\n- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)\n- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)\n","status":"published","published":"2023-10-19T10:03:29Z","modified":"2026-02-04T03:13:19.984469Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4150-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- Update to version 18.18.2\n- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)\n- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)\n- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)\n- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)\n","status":"published","published":"2023-10-20T14:45:56Z","modified":"2026-02-04T02:44:50.424399Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4155-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- Update to version 18.18.2\n- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)\n- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)\n- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)\n- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)\n","status":"published","published":"2023-10-23T07:18:54Z","modified":"2026-02-04T02:57:12.716303Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4207-1","title":"Security update for nodejs18","description":"This update for nodejs18 fixes the following issues:\n\n- Update to version 18.18.2\n- CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)\n- CVE-2023-45143: Fixed a cookie leakage in undici. (bsc#1216205)\n- CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)\n- CVE-2023-39333: Fixed a code injection via WebAssembly export names. (bsc#1216273)\n","status":"published","published":"2023-10-26T08:24:10Z","modified":"2026-02-04T03:57:36.907355Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}