{"id":"VND-nodejs-february-2024-security-releases","kind":"vulnerability","aliases":[],"related":["CVE-2023-46809","CVE-2024-21890","CVE-2024-21891","CVE-2024-21892","CVE-2024-21896","CVE-2024-22017","CVE-2024-22019","CVE-2024-24758","CVE-2024-24806","GHSA-3787-6prv-h9w3"],"title":"Node.js: Wednesday February 14 2024 Security Releases","description":"Security releases available\nUpdates are now available for the v18.x, v20.x and v21.x Node.js release lines for the\nfollowing issues.\nThis security release includes the following dependency updates to address public vulnerabilities:\nlibuv 1.48.0 v21.x (CVE-2024-24806).\nlibuv on v18.x and v20.x has been patched to address CVE-2024-24806.\nundici 5.28.3 on all release lines (CVE-2024-24758, GHSA-3787-6prv-h9w3).\nOpenSSL Security updates\nThis security release includes an OpenSSL update to version 3.0.13+quic1 on all release lines to address advisories:\nOpenSSL security advisory 6th November .\nOpenSSL security advisory 9th January .\nOpenSSL security advisory 15th January .\nOpenSSL security advisory 25th January .\nCode injection and privilege escalation through Linux capabilities (CVE-2024-21892) - (High)\nOn Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE.\nDue to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set.\nThis allows unprivileged users to inject code that inherits the process's elevated privileges.\nImpacts:\nThis vulnerability affects all users in all active release lines: 18.x, 20.x, and 21.x.\nThank you, to Tobias Nießen for reporting this vulnerability and for fixing it.\nReading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019) - (High)\nA vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding,\nleading to resource exhaustion and denial of service (DoS).\nThe server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes.\nThe issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits.\nImpacts:\nThis vulnerability affects all users in all active release lines: 18.x, 20.x, and 21.x.\nThank you, to Bartek Nowotarski for reporting this vulnerability and thank you Paolo Insogna\nfor fixing it.\nPath traversal by monkey-patching Buffer internals (CVE-2024-21896) - (High)\nThe permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user.\nIf the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve().\nBy monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability.\nImpacts:\nThis vulnerability affects all users using the experimental permission model in active release\nlines: 20.x and 21.x.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nThank you, to Tobias Nießen for reporting this vulnerability and for fixing it.\nsetuid() does not drop all privileges due to io_uring (CVE-2024-22017) - (High)\nsetuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().\nThis allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid().\nImpacts:\nThis vulnerability affects all users in active release lines: 20.x, and 21.x.\nThank you, to valette for reporting this vulnerability and thank you Tobias Nießen\nfor fixing it.\nNode.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (CVE-2023-46809) - (Medium)\nA vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel during PKCS#1 v1.5 padding error handling.\nThe vulnerability revealed significant timing differences in decryption for valid and invalid ciphertexts.\nThis poses a serious threat as attackers could remotely exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios involving API endpoints processing Json Web Encryption messages.\nImpacts:\nThis vulnerability affects all users in all active release lines: 18.x, 20.x, and 21.x.\nThank you, to hkario for reporting this vulnerability and thank you Michael Dawson\nfor fixing it.\nMultiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891) - (Medium)\nNode.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwritten with user-defined implementations leading to filesystem permission model bypass through path traversal attack.\nImpacts:\nThis vulnerability affects all users using the experimental permission model in active release\nlines: 20.x and 21.x.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nThank you, to xion for reporting this vulnerability and thank you Rafael Gonzaga\nfor fixing it.\nImproper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890) - (Medium)\nThe Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path.\nFor example: --allow-fs-read=/home/node/.ssh/*.pub will ignore pub and give access to everything after .ssh/.\nImpacts:\nThis misleading documentation affects all users using the experimental permission model in active release\nlines: 20.x and 21.x.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nThank you, to Tobias Nießen for reporting this vulnerability and thank you Rafael Gonzaga\nfor fixing it.\n(Update 13-February-2024) Security Release target Wednesday 14th\nDue to a long pipeline test on this security release, additional time was required.\nTherefore, the new target date is Wednesday 14th.\n(Update 08-February-2024) Security Release target Tuesday 13th\nWe have encountered an error in one of our patches, therefore, the release will take a bit longer than expected\nand the Node.js Security Releases should be available on, or shortly after, Tuesday, February 13th, 2024.\n(Update 06-February-2024) Security Release target Thursday 8th\nPreparing the releases is taking us a bit longer than originally expected and the Node.js Security Releases\nwill be available on, or shortly after, Thursday, February 8th, 2024.\nSummary\nThe Node.js project will release new versions of the 18.x, 20.x and, 21.x\nreleases lines on or shortly after, Tuesday February 6 2024 in order to address:\n4 high severity issues.\n4 medium severity issue.\n1 low severity issue.\nImpact\nThe 21.x release line of Node.js is vulnerable to 4 high severity issues, 4 medium severity issues, and 1 low severity issue.\nThe 20.x release line of Node.js is vulnerable to 4 high severity issues, 4 medium severity issues, and 1 low severity issue.\nIn addition, the 18.x release line of Node.js is vulnerable to 2 high severity issues, 2 medium severity issues, and 1 low severity issue.\nRelease timing\nReleases will be available on, or shortly after, Tuesday February 6 2024.\nContact and future updates\nPlease follow the process outlined in https://github.com/nodejs/node/security/policy if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous Wednesday, April 3, 2024 Security Releases Next OpenSSL Recent Security Patches","summary":"Node.js 18.x, 20.x and 21.x fix a set of issues, the most serious being CVE-2024-21892, where an unprivileged local user can inject code that inherits elevated privileges on Linux, and CVE-2024-22019, where crafted chunked HTTP requests exhaust CPU and bandwidth. The release also updates libuv, undici and OpenSSL, and fixes a timing side channel in privateDecrypt() (CVE-2023-46809).","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":[],"affected":"","ecosystem":"node"},{"name":"node","fixed":[],"affected":"18.x","ecosystem":"node"},{"name":"node","fixed":[],"affected":"20.x","ecosystem":"node"},{"name":"node","fixed":[],"affected":"21.x","ecosystem":"node"}],"ecosystems":["node"],"tags":["http-servers","linux","node","node.js","runtime","self-hosted"],"not_affected_if":["non-linux-hosts","permission-model-disabled"],"how_to_check":"- Run `node --version` and compare against the fixed releases listed below.\n- Check whether the app runs Node.js on Linux with elevated capabilities or setuid, since that is where CVE-2024-21892 applies.\n- For CVE-2024-21896, CVE-2024-21891 and CVE-2024-21890, check whether the experimental permission model (`--experimental-permission`) is in use.","fix":"- Node.js: upgrade to the patched release of your line (18.x, 20.x or 21.x) from the February 14 2024 security releases; exact patch versions are unknown from these sources.\n- undici: upgrade to `5.28.3` where it is used directly.\n- OpenSSL: the bundled OpenSSL is updated to `3.0.13+quic1` in the Node.js releases.","status":"open","published_at":"2024-02-14T15:30:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:41:36+00:00","updated_at":"2026-10-25T05:41:36+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:41:36Z","model":"claude-haiku-5-5","output":{"fix":"- Node.js: upgrade to the patched release of your line (18.x, 20.x or 21.x) from the February 14 2024 security releases; exact patch versions are unknown from these sources.\n- undici: upgrade to `5.28.3` where it is used directly.\n- OpenSSL: the bundled OpenSSL is updated to `3.0.13+quic1` in the Node.js releases.","reach":"internet","title":"Node.js: February 2024 security releases fix several high-severity flaws","impact":"high","summary":"Node.js 18.x, 20.x and 21.x fix a set of issues, the most serious being CVE-2024-21892, where an unprivileged local user can inject code that inherits elevated privileges on Linux, and CVE-2024-22019, where crafted chunked HTTP requests exhaust CPU and bandwidth. The release also updates libuv, undici and OpenSSL, and fixes a timing side channel in privateDecrypt() (CVE-2023-46809).","category":"runtime","nicknames":[],"who_cares":["node.js","self-hosted","linux","http-servers"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Local users inject code with elevated privileges; remote attackers exhaust server resources","analyst_note":"Find the exact patched Node.js versions per release line at https://nodejs.org/en/blog/vulnerability/february-2024-security-releases; the sources give no version numbers for Node itself.","how_to_check":"- Run `node --version` and compare against the fixed releases listed below.\n- Check whether the app runs Node.js on Linux with elevated capabilities or setuid, since that is where CVE-2024-21892 applies.\n- For CVE-2024-21896, CVE-2024-21891 and CVE-2024-21890, check whether the experimental permission model (`--experimental-permission`) is in use.","needs_analyst":true,"not_affected_if":["permission-model-disabled","non-linux-hosts"],"who_is_affected":"Any application running Node.js 18.x, 20.x or 21.x is exposed to the HTTP chunk-extension DoS and the Marvin timing issue, and Linux deployments running with elevated privileges are exposed to the environment-variable code injection. The permission-model bypasses only matter for applications that enable the experimental permission model on 20.x or 21.x.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001025,"input_tokens":6043,"output_tokens":842,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2023':94B,664C '-2024':48B,66B,132C,145C,154C,212C,329C,443C,575C '-21892':49B,213C '-21896':444C '-22017':576C '-22019':67B,330C '-24758':155C '-24806':133C,146C '-3787':157C '-46809':95B,665C '-6':158C '1':660C,686C '1.48.0':129C '14':4A '15th':196C '18':31B,297C,410C '20':33B,299C,412C,527C,624C '2024':5A,12A '21':36B,302C,415C,530C,627C '25th':201C '3.0.13':174C '5.28.3':148C '6th':186C '9th':191C 'activ':294C,407C,524C,621C 'address':125C,143C,181C 'advisori':182C,185C,190C,195C,200C 'affect':289C,402C,515C,581C,617C 'allow':273C,325C,338C,596C,677C 'also':79B 'api':672C 'appli':261C 'applic':498C 'attack':327C,340C,454C,651C,657C,710C 'avail':98C,102C 'bandwidth':76B,388C 'bartek':420C 'bind':247C 'bleichenbach':656C 'bodi':396C 'buffer':440C,474C,482C,492C 'buffer.from':478C 'buffer.prototype':495C 'bug':252C 'bypass':390C 'byte':367C,380C 'call':456C,592C,611C 'cap':245C 'capabl':210C,268C 'caus':384C 'certain':219C,266C 'channel':90B,683C 'chunk':70B,323C,349C,378C 'ciphertext':703C 'code':57B,203C,278C 'connect':371C 'could':711C 'covert':679C 'cpu':74B,385C 'craft':69B,345C 'crypto':675C 'cve':47B,65B,93B,131C,144C,153C,211C,328C,442C,539C,574C,663C 'decrypt':698C 'denial':356C 'depend':122C 'despit':603C 'differ':696C 'dos':326C,359C 'drop':567C,606C 'due':249C,570C 'elev':60B,238C,284C 'encod':350C 'environ':220C 'error':689C 'escal':207C 'even':264C 'except':243C,258C,263C 'exhaust':73B,354C,389C 'experiment':520C,547C 'expl':713C 'exploit':372C 'extens':324C,379C 'featur':548C 'februari':3A 'february':11A 'fix':38B,86B,315C,432C,562C,643C 'follow':114C,121C 'ghsa':156C 'given':461C 'h9w3':161C 'handl':690C 'high':214C,331C,445C,577C 'host':29B 'http':21B,71B,319C,336C,346C 'http-server':20B 'ignor':218C 'impact':286C,399C,512C,614C 'implement':255C,476C 'includ':119C,168C 'incorrect':260C 'inherit':59B,280C 'initi':589C 'inject':56B,204C,277C 'insogna':430C 'intern':441C,493C,584C 'invalid':702C 'io':572C,585C 'issu':42B,115C,382C,541C 'januari':192C,197C,202C 'lack':374C 'lead':351C,506C 'librari':676C 'libuv':81B,128C,134C,582C 'like':393C 'limit':376C,398C 'line':111C,152C,179C,296C,409C,526C,623C 'linux':23B,63B,209C,216C 'local':53B 'marvin':650C 'may':224C 'medium':666C 'model':448C,522C,544C 'modifi':500C 'monkey':438C,490C 'monkey-patch':437C,489C 'name':494C 'net':246C 'network':387C 'nießen':308C,555C,641C 'node':16A,17A,18A,19A,24B 'node.js':1A,25B,30B,109C,217C,259C,335C,550C,645C 'nodejs':10A 'note':533C 'novemb':187C 'nowotarski':421C 'number':365C 'obtain':480C 'openssl':84B,162C,170C,183C,188C,193C,198C 'oper':587C,602C 'pad':662C,688C 'paolo':429C 'patch':141C,439C,491C 'path':434C,452C,460C,467C,509C 'path.resolve':457C,487C,504C 'perform':600C 'permiss':447C,521C,543C 'pkcs':659C,685C 'pleas':532C 'pose':705C 'presum':604C 'privatedecrypt':92B,671C 'privileg':61B,206C,239C,285C,569C,601C,608C 'process':234C,282C,598C 'protect':449C 'prv':160C 'prv-h9w3':159C 'public':126C 'quic1':175C 'read':317C,362C 'releas':7A,78B,97C,110C,118C,151C,167C,178C,295C,408C,525C,622C 'releases':15A 'remot':712C 'report':310C,423C,557C,634C 'request':72B,320C,347C 'resourc':353C 'result':485C,502C 'reveal':693C 'run':236C 'runtim':26B 'safeguard':392C 'secur':6A,96C,117C,163C,166C,184C,189C,194C,199C 'security':14A 'security-releases':13A 'self':28B 'self-host':27B 'send':342C 'serious':45B,707C 'server':22B,337C,361C 'servic':248C,358C 'set':40B,227C,271C 'setuid':564C,578C,594C,613C 'side':89B,682C 'side-channel':681C 'signific':694C 'singl':370C 'size':397C 'special':344C 'standard':391C 'thank':304C,417C,427C,551C,629C,638C 'threat':708C 'time':88B,537C,652C,680C,695C 'timeout':394C 'tobia':307C,554C,640C 'travers':435C,453C,510C 'treat':471C 'unbound':322C,364C 'undici':82B,147C 'unprivileg':52B,230C,274C 'unprocess':318C 'updat':80B,99C,123C,164C,171C 'ure':573C,586C 'use':477C,518C 'user':54B,231C,275C,291C,404C,464C,517C,619C 'utf8write':496C 'v1.5':661C,687C 'v18.x':105C,136C 'v20.x':106C,138C 'v21.x':108C,130C 'valett':632C 'valid':700C 'variabl':221C 'variant':653C 'version':173C 'vnd':9A 'vnd-nodejs-february':8A 'vulner':127C,288C,312C,333C,401C,425C,511C,514C,559C,616C,636C,647C,668C,692C 'wednesday':2A 'x':32B,34B,37B,298C,300C,303C,411C,413C,416C,528C,531C,625C,628C","nicknames":[],"mitigations":[],"who_affected":"Any application running Node.js 18.x, 20.x or 21.x is exposed to the HTTP chunk-extension DoS and the Marvin timing issue, and Linux deployments running with elevated privileges are exposed to the environment-variable code injection. The permission-model bypasses only matter for applications that enable the experimental permission model on 20.x or 21.x.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-02-14T15:30:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"february-2024-security-releases","url":"https://nodejs.org/en/blog/vulnerability/february-2024-security-releases","severity":"high","published_at":"2024-02-14T15:30:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T17:36:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}