{"id":"VND-nodejs-august-2023-security-releases","kind":"vulnerability","aliases":[],"related":["CVE-2023-32002","CVE-2023-32003","CVE-2023-32004","CVE-2023-32005","CVE-2023-32006","CVE-2023-32558","CVE-2023-32559"],"title":"Node.js: Wednesday August 9th 2023 Security Releases","description":"Security releases available\nUpdates are now available for the v16.x, v18.x, and v20.x Node.js release lines for the\nfollowing issues.\nPermissions policies can be bypassed via Module._load (HIGH)(CVE-2023-32002)\nThe use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json\ndefinition for a given module.\nPlease note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.\nImpacts:\nThis vulnerability affects all users using the experimental policy mechanism in all active release\nlines: 16.x, 18.x and, 20.x.\nThank you, to mattaustin for reporting this vulnerability and thank you Rafael Gonzaga\nand Bradley Farias for fixing it.\nPermission model bypass by specifying a path traversal sequence in a Buffer (HIGH)(CVE-2023-32004)\nA vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model.\nThis flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when\nverifying file permissions.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nImpacts:\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\nThank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga\nfor fixing it.\nprocess.binding() can bypass the permission model through path traversal (HIGH)(CVE-2023-32558)\nThe use of the deprecated API process.binding() can bypass the permission model through path traversal.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nImpacts:\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\nThank you to Rafael Gonzaga for reporting and fixing this vulnerability.\nPermissions policies can impersonate other modules in using module.constructor.createRequire() (MEDIUM)(CVE-2023-32006)\nThe use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the\npolicy.json definition for a given module.\nPlease note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.\nImpacts:\nThis vulnerability affects all users using the experimental policy mechanism in all active release\nlines: 16.x, 18.x and, 20.x.\nThank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga\nand Bradley Farias for fixing it.\nPermissions policies can be bypassed via process.binding (MEDIUM)(CVE-2023-32559)\nThe use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules\nand eventually take advantage of process.binding(&#x27;spawn_sync&#x27;) run arbitrary code, outside of the\nlimits defined in a policy.json file.\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.\nImpacts\nThis vulnerability affects all users using the experimental policy mechanism in all active release\nlines: 16.x, 18.x and, 20.x.\nThank you, to LeoDog896 for reporting this vulnerability and thank you Tobias Nießen\nfor fixing it.\nfs.statfs can retrieve stats from files restricted by the Permission Model (LOW)(CVE-2023-32005)\nA vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- * argument.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.statfs API.\nAs a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nImpacts:\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\nThank you to Rafael Gonzaga for reporting and fixing this vulnerability.\nfs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks (LOW)(CVE-2023-32003)\nfs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack.\nThis flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an\narbitrary directory.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nImpacts:\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\nThank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga\nfor fixing it.\nDownloads and release details\nNode.js v16.20.2 (LTS)\nNode.js v18.17.1 (LTS)\nNode.js v20.5.1 (Current)\n(Update 08-Aug-2023) Security Release target August 9th\nThe Node.js Security Releases will be available on, or shortly after, Wednesday, August 9th, 2023.\nSummary\nThe Node.js project will release new versions of the 16.x, 18.x and 20.x\nreleases lines on or shortly after, Tuesday August 8th 2023 in order to address:\n3 high severity issues.\n2 medium severity issues.\n2 low severity issues.\nOpenSSL Security updates\nThis security release includes the following OpenSSL security updates\nOpenSSL security advisory 14th July .\nOpenSSL security advisory 19th July .\nOpenSSL security advisory 31st July .\nImpact\nThe 20.x release line of Node.js is vulnerable to 3 high severity issues, 2 medium severity issues,\nand 2 low severity issues.\nThe 18.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues.\nThe 16.x release line of Node.js is vulnerable to 1 high severity issue, and 2 medium severity issues.\nRelease timing\nReleases will be available on, or shortly after, Tuesday August 8th 2023.\nContact and future updates\nThe current Node.js security policy can be found at /security/. Please follow the process outlined in https://github.com/nodejs/node/security/policy if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous Friday October 13 2023 Security Releases Next Tuesday June 20 2023 Security Releases","summary":"Node.js August 2023 security releases fix several flaws in the experimental policy and permission model, where code can load modules or read and create files outside its allowed set. Some of these bypasses, such as Module._load and process.binding, can reach internal modules and in one case spawn_sync, so an attacker running code inside a policy-restricted process could escape its limits.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":["16.20.2"],"affected":">= 16.0.0, < 16.20.2","ecosystem":"node"},{"name":"node","fixed":["18.17.1"],"affected":">= 18.0.0, < 18.17.1","ecosystem":"node"},{"name":"node","fixed":["20.5.1"],"affected":">= 20.0.0, < 20.5.1","ecosystem":"node"}],"ecosystems":["node"],"tags":["node","nodejs-runtime","runtime","self-hosted"],"not_affected_if":["default-config","no-experimental-policy","no-permission-model"],"how_to_check":"- Run `node --version` and compare against the fixed lines: 16.20.2, 18.17.1, 20.5.1.\n- Check whether `--experimental-policy`, `--experimental-permission` or `--allow-fs-read` are used in startup scripts, Dockerfiles or service units.\n- Look for a `policy.json` file or calls to `Module._load`, `process.binding` or `module.constructor.createRequire` in your code.","fix":"- Upgrade Node.js 16.x to `16.20.2` or later.\n- Upgrade Node.js 18.x to `18.17.1` or later.\n- Upgrade Node.js 20.x to `20.5.1` or later.","status":"open","published_at":"2023-08-09T14:30:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:41:39+00:00","updated_at":"2026-10-25T05:41:39+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-25T05:41:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js 16.x to `16.20.2` or later.\n- Upgrade Node.js 18.x to `18.17.1` or later.\n- Upgrade Node.js 20.x to `20.5.1` or later.","reach":"unknown","title":"Node.js: policy and permission model bypasses let code escape restrictions","impact":"high","summary":"Node.js August 2023 security releases fix several flaws in the experimental policy and permission model, where code can load modules or read and create files outside its allowed set. Some of these bypasses, such as Module._load and process.binding, can reach internal modules and in one case spawn_sync, so an attacker running code inside a policy-restricted process could escape its limits.","category":"runtime","nicknames":[],"who_cares":["node","self-hosted","nodejs-runtime"],"confidence":0.8,"needs_auth":"unknown","worst_case":"sandboxed code escapes policy and runs arbitrary commands","analyst_note":"","how_to_check":"- Run `node --version` and compare against the fixed lines: 16.20.2, 18.17.1, 20.5.1.\n- Check whether `--experimental-policy`, `--experimental-permission` or `--allow-fs-read` are used in startup scripts, Dockerfiles or service units.\n- Look for a `policy.json` file or calls to `Module._load`, `process.binding` or `module.constructor.createRequire` in your code.","needs_analyst":false,"not_affected_if":["default-config","no-experimental-policy","no-permission-model"],"who_is_affected":"Only deployments using the experimental policy mechanism or the experimental permission model are exposed, since the sources say the bugs affect those features. Teams running Node.js without these flags enabled can upgrade on the normal schedule rather than treating it as urgent.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000889,"input_tokens":5601,"output_tokens":658,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2023':119C,217C,317C,389C,483C,591C '-32002':120C '-32004':218C '-32005':592C '-32006':390C '-32558':318C '-32559':484C '16':177C,447C,555C '18':179C,449C,557C '20':182C,227C,288C,366C,452C,560C,601C,691C '2023':5A,12A,29B '9th':4A 'access':657C 'activ':174C,444C,552C 'actor':644C 'advantag':504C 'affect':164C,278C,356C,434C,542C,602C,681C 'allow':54B,612C 'allow-fs-read':611C 'api':245C,324C,490C,639C 'arbitrari':510C 'argument':621C 'aris':624C 'attack':77B 'august':3A,11A,28B 'avail':92C,96C 'axel':292C,457C 'bradley':198C,469C 'buffer':214C,241C 'bypass':59B,114C,126C,205C,251C,308C,327C,396C,478C,493C 'case':72B 'caus':246C 'chong':293C,458C 'code':43B,79B,511C 'could':86B 'creat':50B 'cve':118C,149C,216C,263C,316C,341C,388C,419C,482C,528C,590C,666C 'defin':516C 'definit':137C,407C 'deprec':323C,489C 'discov':223C 'escap':87B 'eventu':502C 'experiment':37B,157C,169C,231C,271C,283C,349C,361C,427C,439C,535C,547C,606C,674C,686C 'explicit':655C 'fail':631C 'faria':199C,470C 'featur':158C,272C,350C,428C,536C,675C 'file':51B,243C,254C,520C,583C,634C,649C 'fix':32B,201C,304C,375C,472C,576C,700C 'flag':615C 'flaw':34B,235C,623C 'follow':108C 'fs':613C 'fs.mkdtemp':703C 'fs.mkdtempsync':705C 'fs.statfs':578C,638C 'given':140C,410C 'gonzaga':196C,302C,371C,467C,696C 'handl':239C 'high':117C,215C,315C 'host':26B 'identifi':597C 'impact':161C,275C,353C,431C,539C,678C 'imperson':381C 'improp':238C 'inadequ':627C 'insid':80B 'intern':67B,499C 'issu':109C,151C,265C,343C,421C,530C,668C 'leodog896':565C 'limit':89B,515C 'line':105C,176C,446C,554C 'load':45B 'low':589C 'malici':643C 'mattaustin':187C 'mechan':129C,154C,171C,399C,424C,441C,496C,549C 'medium':387C,481C 'missi':707C 'model':41B,204C,233C,268C,285C,311C,330C,346C,363C,588C,608C,629C,671C,688C 'modul':46B,68B,132C,141C,383C,402C,411C,500C 'module._load':62B,116C,124C 'module.constructor.createrequire':386C,394C 'nießen':574C 'node':16A,17A,18A,19B 'node.js':1A,27B,103C,160C,225C,274C,287C,352C,365C,430C,538C,599C,677C,690C 'nodej':21B 'nodejs':10A 'nodejs-runtim':20B 'non':620C 'note':143C,257C,335C,413C,522C,660C 'one':71B 'outsid':52B,133C,403C,512C 'path':209C,249C,313C,332C 'permiss':40B,110C,203C,232C,255C,267C,284C,310C,329C,345C,362C,378C,474C,587C,607C,628C,670C,687C 'pleas':142C,256C,334C,412C,521C,659C 'polici':38B,83B,111C,128C,153C,170C,379C,398C,423C,440C,475C,495C,532C,548C 'policy-restrict':82B 'policy.json':136C,406C,519C 'process':85B 'process.binding':64B,306C,325C,480C,491C,506C 'rafael':195C,301C,370C,466C,695C 'reach':66B 'read':48B,614C,656C 'relat':236C 'releas':7A,31B,91C,104C,175C,445C,553C 'releases':15A 'report':189C,295C,373C,460C,567C,698C 'requir':131C,401C,498C 'restrict':84B,584C,633C 'result':642C 'retriev':580C,646C 'run':78B,509C 'runtim':22B,23B 'secur':6A,30B,90C 'security':14A 'security-releases':13A 'self':25B 'self-host':24B 'sequenc':211C 'set':55B 'sever':33B 'spawn':73B,507C 'specif':228C 'specifi':207C 'stat':581C,635C,647C 'sync':74B,508C 'system':244C 'take':503C 'thank':184C,193C,289C,299C,367C,454C,464C,562C,571C,692C 'time':147C,261C,339C,417C,526C,664C 'tobia':573C 'travers':210C,248C,314C,333C 'updat':93C 'use':122C,167C,281C,320C,359C,385C,392C,437C,486C,545C,617C,684C 'user':166C,280C,358C,436C,544C,603C,683C 'v16.x':99C 'v18.x':100C 'v20.x':102C 'verifi':253C 'version':226C,600C 'via':115C,479C 'vnd':9A 'vnd-nodejs-august':8A 'vulner':163C,191C,220C,277C,297C,355C,377C,433C,462C,541C,569C,594C,680C,702C 'wednesday':2A 'within':229C 'x':178C,180C,183C,448C,450C,453C,556C,558C,561C","nicknames":[],"mitigations":[],"who_affected":"Only deployments using the experimental policy mechanism or the experimental permission model are exposed, since the sources say the bugs affect those features. Teams running Node.js without these flags enabled can upgrade on the normal schedule rather than treating it as urgent.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2023-08-09T14:30:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"august-2023-security-releases","url":"https://nodejs.org/en/blog/vulnerability/august-2023-security-releases","severity":"high","published_at":"2023-08-09T14:30:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T14:54:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}