Skip to content
Heist/ feed
UnratedFix available

Node.js 20.3.1 (Current)

Type: patchSource: Node.js announcements1 source record

Node.js 20.3.1 fixes multiple security vulnerabilities, including issues in the experimental policy and permission mechanisms, installer repair, and HTTP request handling.

Announced Group revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 20.3.1 (Current)
Affected versions
Not stated in this extraction
Fixed versions
20.3.1
Node.js 20.3.1 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2023-30581
CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30584
CVE-2023-30584: Path Traversal Bypass in Experimental Permission Model (High)
CVE-2023-30587
CVE-2023-30587: Bypass of Experimental Permission Model via Node.js Inspector (High)
CVE-2023-30582
CVE-2023-30582: Inadequate Permission Model Allows Unauthorized File Watching (Medium)
CVE-2023-30583
CVE-2023-30583: Bypass of Experimental Permission Model via fs.openAsBlob() (Medium)
CVE-2023-30585
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30586
CVE-2023-30586: Bypass of Experimental Permission Model via Arbitrary OpenSSL Engines (Medium)
CVE-2023-30588
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)

Publisher severity

No explicit severity was extracted.

Event
#27670 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. nodejs · Revision 1Source updated