Skip to content
Heist/ feed
UnratedFix available

Node.js security releases for June 20, 2023

Type: patchSource: Node.js announcements1 source record

Security updates address vulnerabilities in Node.js and bundled OpenSSL and c-ares components. Updated releases are Node.js v16.20.1, v18.16.1, and v20.3.1.

Announced Source revision 1
Original source ↗

nodejs

Primary source · Revision 1

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for all supported Node.js release lines for the following issues.

Node.js

Node.js v16.20.1 (LTS)
Affected versions
16.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
18.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
20.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Fixed versions
Node.js v16.20.1
Node.js v16.20.1 (LTS)
Node.js v18.16.1
Node.js v18.16.1 (LTS)
Node.js v20.3.1
Node.js v20.3.1 (Current)
Prerequisites
using the experimental policy mechanism
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
using the experimental permission model
This vulnerability affects all users using the experimental permission model in Node.js 20.
Related CVEs
CVE-2023-30581
mainModule.proto bypass experimental policy mechanism (High) (CVE-2023-30581)
CVE-2023-30584
Path traversal bypass in experimental permission model (High) (CVE-2023-30584)
CVE-2023-30587
Inspector protocol bypass the experimental permission model (High) (CVE-2023-30587)
CVE-2023-30582
fs.watchFile bypass in experimental permission model (Medium) (CVE-2023-30582)
CVE-2023-30583
fs.openAsBlob bypass in experimental permission model (Medium) (CVE-2023-30583)
CVE-2023-30585
Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) (CVE-2023-30585)
CVE-2023-30586
OpenSSL engines can be used to bypass the permission model (Medium) (CVE-2023-30586)
CVE-2023-30588
Process interruption due to invalid Public Key information in x509 certificates (Medium) (CVE-2023-30588)
CVE-2023-30589
HTTP Request Smuggling via Empty headers separated by CR (Medium) (CVE-2023-30589)
CVE-2023-30590
DiffieHellman do not generate keys after setting a private key (Medium) (CVE-2023-30590)

Publisher severity

No explicit severity was extracted.

Event
#28023 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement