High severity · published Feb 23, 2023
CVE-2023-23919
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set…
7.5
CVSS
2.2%
EPSS
No
On KEV
Description
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Node.js · Nodejs
14.0.0 through 14.14.0; 14.0.0 before 14.21.3; 16.0.0 through 16.12.0; 16.0.0 before 16.19.1; 18.0.0 through 18.11.0; 18.0.0 before 18.14.1; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23919
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23919
Exploit
https://hackerone.com/reports/1808596
Patch
https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
security.netapp.com
https://security.netapp.com/advisory/ntap-20230316-0008/
More from Node.js
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2026-21636
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled
9.8
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
9.8
CVE-2024-3566
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific…
9.8
CVE-2024-21896
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user