{"schema_version":"1","data":[{"id":28023,"advisory_id":"c28269c2-277e-4b0d-ba0f-b993e0d93815","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/june-2023-security-releases","source_published_at":"2023-06-20T14:30:00+00:00","published_at":"2026-10-25T07:35:25.619836+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-30581","CVE-2023-30582","CVE-2023-30583","CVE-2023-30584","CVE-2023-30585","CVE-2023-30586","CVE-2023-30587","CVE-2023-30588","CVE-2023-30589","CVE-2023-30590"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js security releases for June 20, 2023","summary":"Security updates address vulnerabilities in Node.js and bundled OpenSSL and c-ares components. Updated releases are Node.js v16.20.1, v18.16.1, and v20.3.1.","evidence":"Updates are now available for all supported Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v16.20.1 (LTS)"},"prerequisites":[{"value":"using the experimental policy mechanism","evidence":"This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x."},{"value":"using the experimental permission model","evidence":"This vulnerability affects all users using the experimental permission model in Node.js 20."}],"fixed_versions":[{"value":"Node.js v16.20.1","evidence":"Node.js v16.20.1 (LTS)"},{"value":"Node.js v18.16.1","evidence":"Node.js v18.16.1 (LTS)"},{"value":"Node.js v20.3.1","evidence":"Node.js v20.3.1 (Current)"}],"affected_versions":[{"value":"16.x","evidence":"This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x."},{"value":"18.x","evidence":"This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x."},{"value":"20.x","evidence":"This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-30581","evidence":"mainModule.proto bypass experimental policy mechanism (High) (CVE-2023-30581)"},{"value":"CVE-2023-30584","evidence":"Path traversal bypass in experimental permission model (High) (CVE-2023-30584)"},{"value":"CVE-2023-30587","evidence":"Inspector protocol bypass the experimental permission model (High) (CVE-2023-30587)"},{"value":"CVE-2023-30582","evidence":"fs.watchFile bypass in experimental permission model (Medium) (CVE-2023-30582)"},{"value":"CVE-2023-30583","evidence":"fs.openAsBlob bypass in experimental permission model (Medium) (CVE-2023-30583)"},{"value":"CVE-2023-30585","evidence":"Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) (CVE-2023-30585)"},{"value":"CVE-2023-30586","evidence":"OpenSSL engines can be used to bypass the permission model (Medium) (CVE-2023-30586)"},{"value":"CVE-2023-30588","evidence":"Process interruption due to invalid Public Key information in x509 certificates (Medium) (CVE-2023-30588)"},{"value":"CVE-2023-30589","evidence":"HTTP Request Smuggling via Empty headers separated by CR (Medium) (CVE-2023-30589)"},{"value":"CVE-2023-30590","evidence":"DiffieHellman do not generate keys after setting a private key (Medium) (CVE-2023-30590)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":27685,"advisory_id":"15c2af05-6e98-42ae-a58e-3fb483cdb508","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v16.20.1","source_published_at":"2023-06-20T19:27:28+00:00","published_at":"2026-10-25T07:29:35.343258+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-30581","CVE-2023-30585","CVE-2023-30588","CVE-2023-30589","CVE-2023-30590"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 16.20.1 (LTS)","summary":"Node.js 16.20.1 fixes multiple listed vulnerabilities, including issues in policy handling, the Windows installer, HTTP headers, and cryptographic operations.","evidence":"The following CVEs are fixed in this release:","products":[{"name":{"value":"Node.js","evidence":"Node.js 16.20.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"16.20.1","evidence":"Node.js 16.20.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-30581","evidence":"CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)"},{"value":"CVE-2023-30585","evidence":"CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)"},{"value":"CVE-2023-30588","evidence":"CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)"},{"value":"CVE-2023-30589","evidence":"CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)"},{"value":"CVE-2023-30590","evidence":"CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":27670,"advisory_id":"223b8bea-0eb0-44d3-81c4-ad963f65896e","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.3.1","source_published_at":"2023-06-20T20:13:40+00:00","published_at":"2026-10-25T07:29:23.214235+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-30581","CVE-2023-30582","CVE-2023-30583","CVE-2023-30584","CVE-2023-30585","CVE-2023-30586","CVE-2023-30587","CVE-2023-30588","CVE-2023-30589","CVE-2023-30590"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 20.3.1 (Current)","summary":"Node.js 20.3.1 fixes multiple security vulnerabilities, including issues in the experimental policy and permission mechanisms, installer repair, and HTTP request handling.","evidence":"The following CVEs are fixed in this release:","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.3.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"20.3.1","evidence":"Node.js 20.3.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-30581","evidence":"CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)"},{"value":"CVE-2023-30584","evidence":"CVE-2023-30584: Path Traversal Bypass in Experimental Permission Model (High)"},{"value":"CVE-2023-30587","evidence":"CVE-2023-30587: Bypass of Experimental Permission Model via Node.js Inspector (High)"},{"value":"CVE-2023-30582","evidence":"CVE-2023-30582: Inadequate Permission Model Allows Unauthorized File Watching (Medium)"},{"value":"CVE-2023-30583","evidence":"CVE-2023-30583: Bypass of Experimental Permission Model via fs.openAsBlob() (Medium)"},{"value":"CVE-2023-30585","evidence":"CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)"},{"value":"CVE-2023-30586","evidence":"CVE-2023-30586: Bypass of Experimental Permission Model via Arbitrary OpenSSL Engines (Medium)"},{"value":"CVE-2023-30588","evidence":"CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)"},{"value":"CVE-2023-30589","evidence":"CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)"},{"value":"CVE-2023-30590","evidence":"CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false},{"id":27543,"advisory_id":"de2937c1-255f-4d0f-806f-7e418e97ef20","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v18.16.1","source_published_at":"2023-06-20T20:33:42+00:00","published_at":"2026-10-25T07:27:22.43027+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-30581","CVE-2023-30585","CVE-2023-30588","CVE-2023-30589","CVE-2023-30590"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 18.16.1 (LTS)","summary":"Node.js 18.16.1 fixes multiple security vulnerabilities, including issues involving policy bypass, installer repair, HTTP request smuggling, and certificate handling.","evidence":"The following CVEs are fixed in this release:","products":[{"name":{"value":"Node.js","evidence":"Node.js 18.16.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"18.16.1","evidence":"Node.js 18.16.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-30581","evidence":"CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)"},{"value":"CVE-2023-30585","evidence":"CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)"},{"value":"CVE-2023-30588","evidence":"CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)"},{"value":"CVE-2023-30589","evidence":"CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)"},{"value":"CVE-2023-30590","evidence":"CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":28023,"next_before":27543}