UnratedFix available
Node.js 20.5.1 (Current)
Node.js 20.5.1 fixes multiple policy and permission-model bypass vulnerabilities, including issues rated High, Medium, and Low.
Announced Group revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
The following CVEs are fixed in this release:
Node.js
Node.js 20.5.1 (Current)
- Affected versions
- Not stated in this extraction
- Fixed versions
- 20.5.1
Node.js 20.5.1 (Current)
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2023-32002
CVE-2023-32002: Policies can be bypassed via Module._load (High)
CVE-2023-32558CVE-2023-32558: process.binding() can bypass the permission model through path traversal (High)
CVE-2023-32004CVE-2023-32004: Permission model can be bypassed by specifying a path traversal sequence in a Buffer (High)
CVE-2023-32006CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
CVE-2023-32559CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
CVE-2023-32005CVE-2023-32005: fs.statfs can bypass the permission model (Low)
CVE-2023-32003CVE-2023-32003: fs.mkdtemp() and fs.mkdtempSync() can bypass the permission model (Low)
Publisher severity
No explicit severity was extracted.
- Event
- #27124 · Revision 1
- Added to Heist Feed
- Publisher date