Skip to content
Heist/ feed
UnratedFix available

Node.js security releases

Type: patchSource: Node.js announcements1 source record

Security updates address multiple vulnerabilities in Node.js 16.x, 18.x and 20.x, including issues involving experimental policy and permission mechanisms. Updates are available in Node.js v16.20.2, v18.17.1 and v20.5.1.

Announced Source revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for the v16.x, v18.x, and v20.x Node.js release lines for the following issues.

Node.js

Node.js v16.20.2 (LTS)
Affected versions
16.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
18.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
20.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Fixed versions
v16.20.2
Node.js v16.20.2 (LTS)
v18.17.1
Node.js v18.17.1 (LTS)
v20.5.1
Node.js v20.5.1 (Current)
Prerequisites
using the experimental policy mechanism
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
using the experimental permission model
This vulnerability affects all users using the experimental permission model in Node.js 20.
Related CVEs
CVE-2023-32002
Permissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002)
CVE-2023-32004
Permission model bypass by specifying a path traversal sequence in a Buffer (HIGH)(CVE-2023-32004)
CVE-2023-32558
process.binding() can bypass the permission model through path traversal (HIGH)(CVE-2023-32558)
CVE-2023-32006
Permissions policies can impersonate other modules in using module.constructor.createRequire() (MEDIUM)(CVE-2023-32006)
CVE-2023-32559
Permissions policies can be bypassed via process.binding (MEDIUM)(CVE-2023-32559)
CVE-2023-32005
fs.statfs can retrieve stats from files restricted by the Permission Model (LOW)(CVE-2023-32005)
CVE-2023-32003
fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (LOW)(CVE-2023-32003)

Publisher severity

No explicit severity was extracted.

Event
#27448 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement