{"schema_version":"1","view":"events","data":[{"id":27448,"advisory_id":"1b5cc8b7-b98d-4821-a2a1-4b754f1892c8","group_id":"advisory:1b5cc8b7-b98d-4821-a2a1-4b754f1892c8","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/vulnerability/august-2023-security-releases","source_published_at":"2023-08-09T14:30:00+00:00","published_at":"2026-10-25T07:25:43.758681+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-32002","CVE-2023-32003","CVE-2023-32004","CVE-2023-32005","CVE-2023-32006","CVE-2023-32558","CVE-2023-32559"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js security releases","summary":"Security updates address multiple vulnerabilities in Node.js 16.x, 18.x and 20.x, including issues involving experimental policy and permission mechanisms. Updates are available in Node.js v16.20.2, v18.17.1 and v20.5.1.","evidence":"Updates are now available for the v16.x, v18.x, and v20.x Node.js release lines for the following issues.","products":[{"name":{"value":"Node.js","evidence":"Node.js v16.20.2 (LTS)"},"prerequisites":[{"value":"using the experimental policy mechanism","evidence":"This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x."},{"value":"using the experimental permission model","evidence":"This vulnerability affects all users using the experimental permission model in Node.js 20."}],"fixed_versions":[{"value":"v16.20.2","evidence":"Node.js v16.20.2 (LTS)"},{"value":"v18.17.1","evidence":"Node.js v18.17.1 (LTS)"},{"value":"v20.5.1","evidence":"Node.js v20.5.1 (Current)"}],"affected_versions":[{"value":"16.x","evidence":"This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x."},{"value":"18.x","evidence":"This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x."},{"value":"20.x","evidence":"This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x."}]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-32002","evidence":"Permissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002)"},{"value":"CVE-2023-32004","evidence":"Permission model bypass by specifying a path traversal sequence in a Buffer (HIGH)(CVE-2023-32004)"},{"value":"CVE-2023-32558","evidence":"process.binding() can bypass the permission model through path traversal (HIGH)(CVE-2023-32558)"},{"value":"CVE-2023-32006","evidence":"Permissions policies can impersonate other modules in using module.constructor.createRequire() (MEDIUM)(CVE-2023-32006)"},{"value":"CVE-2023-32559","evidence":"Permissions policies can be bypassed via process.binding (MEDIUM)(CVE-2023-32559)"},{"value":"CVE-2023-32005","evidence":"fs.statfs can retrieve stats from files restricted by the Permission Model (LOW)(CVE-2023-32005)"},{"value":"CVE-2023-32003","evidence":"fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (LOW)(CVE-2023-32003)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/27448"},{"id":27207,"advisory_id":"02f221d3-cdb8-44d7-8805-df789e23931b","group_id":"advisory:02f221d3-cdb8-44d7-8805-df789e23931b","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v16.20.2","source_published_at":"2023-08-09T16:51:54+00:00","published_at":"2026-10-25T07:21:21.976908+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-32002","CVE-2023-32006","CVE-2023-32559"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 16.20.2 (LTS)","summary":"Node.js 16.20.2 fixes three policy-bypass vulnerabilities and includes OpenSSL security updates.","evidence":"The following CVEs are fixed in this release: CVE-2023-32002: Policies can be bypassed via Module._load","products":[{"name":{"value":"Node.js","evidence":"Node.js 16.20.2 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"16.20.2","evidence":"Node.js 16.20.2 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-32002","evidence":"CVE-2023-32002: Policies can be bypassed via Module._load (High)"},{"value":"CVE-2023-32006","evidence":"CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)"},{"value":"CVE-2023-32559","evidence":"CVE-2023-32559: Policies can be bypassed via process.binding (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/27207"},{"id":27206,"advisory_id":"9dd862c2-58bf-4110-8b21-69bdb66e5cbd","group_id":"advisory:9dd862c2-58bf-4110-8b21-69bdb66e5cbd","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v18.17.1","source_published_at":"2023-08-09T17:09:37+00:00","published_at":"2026-10-25T07:21:21.499203+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-32002","CVE-2023-32006","CVE-2023-32559"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 18.17.1 (LTS)","summary":"Node.js 18.17.1 fixes three policy-bypass vulnerabilities and includes OpenSSL security updates.","evidence":"The following CVEs are fixed in this release: CVE-2023-32002: Policies can be bypassed via Module._load (High)","products":[{"name":{"value":"Node.js","evidence":"Node.js 18.17.1 (LTS)"},"prerequisites":[],"fixed_versions":[{"value":"18.17.1","evidence":"Node.js 18.17.1 (LTS)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-32002","evidence":"CVE-2023-32002: Policies can be bypassed via Module._load (High)"},{"value":"CVE-2023-32006","evidence":"CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)"},{"value":"CVE-2023-32559","evidence":"CVE-2023-32559: Policies can be bypassed via process.binding (Medium)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/27206"},{"id":27124,"advisory_id":"09ad5a70-8a07-4b3a-a4e1-fdbd986c7996","group_id":"advisory:09ad5a70-8a07-4b3a-a4e1-fdbd986c7996","revision":1,"source_id":"nodejs","source_url":"https://nodejs.org/en/blog/release/v20.5.1","source_published_at":"2023-08-09T17:55:32+00:00","published_at":"2026-10-25T07:20:22.994313+00:00","extraction_method":"llm","technologies":["node-js","nodejs"],"cve_ids":["CVE-2023-32002","CVE-2023-32003","CVE-2023-32004","CVE-2023-32005","CVE-2023-32006","CVE-2023-32558","CVE-2023-32559"],"event_types":["patch"],"payload":{"kind":"patch","title":"Node.js 20.5.1 (Current)","summary":"Node.js 20.5.1 fixes multiple policy and permission-model bypass vulnerabilities, including issues rated High, Medium, and Low.","evidence":"The following CVEs are fixed in this release:","products":[{"name":{"value":"Node.js","evidence":"Node.js 20.5.1 (Current)"},"prerequisites":[],"fixed_versions":[{"value":"20.5.1","evidence":"Node.js 20.5.1 (Current)"}],"affected_versions":[]}],"severity":"unknown","related_cves":[{"value":"CVE-2023-32002","evidence":"CVE-2023-32002: Policies can be bypassed via Module._load (High)"},{"value":"CVE-2023-32558","evidence":"CVE-2023-32558: process.binding() can bypass the permission model through path traversal (High)"},{"value":"CVE-2023-32004","evidence":"CVE-2023-32004: Permission model can be bypassed by specifying a path traversal sequence in a Buffer (High)"},{"value":"CVE-2023-32006","evidence":"CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)"},{"value":"CVE-2023-32559","evidence":"CVE-2023-32559: Policies can be bypassed via process.binding (Medium)"},{"value":"CVE-2023-32005","evidence":"CVE-2023-32005: fs.statfs can bypass the permission model (Low)"},{"value":"CVE-2023-32003","evidence":"CVE-2023-32003: fs.mkdtemp() and fs.mkdtempSync() can bypass the permission model (Low)"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false,"detail_url":"/events/27124"}],"next_after":27448,"next_before":27124}