{"id":"VND-nodejs-june-2023-security-releases","kind":"vulnerability","aliases":[],"related":["CVE-2023-30581","CVE-2023-30582","CVE-2023-30583","CVE-2023-30584","CVE-2023-30585","CVE-2023-30586","CVE-2023-30587","CVE-2023-30588","CVE-2023-30589","CVE-2023-30590","GHSA-54xr-f67r-4pc4","GHSA-8r8p-23f3-64c2","GHSA-9g78-jv2r-p7vc","GHSA-x6mf-cxr9-8q6v"],"title":"Node.js: Tuesday June 20 2023 Security Releases","description":"Security releases available\nUpdates are now available for all supported Node.js release lines for the following\nissues.\nOpenSSL Security updates\nThis security release includes the following OpenSSL security updates\nOpenSSL security advisory 28th March .\nOpenSSL security advisory 20th April .\nOpenSSL security advisory 30th May .\nImpacts:\nAll versions of the 20.x, 18.x, and 16.x release lines.\nc-ares Security updates\nThis security release includes c-ares security updates as outlined in the recent\nadvisories:\nGHSA-9g78-jv2r-p7vc\nGHSA-8r8p-23f3-64c2\nGHSA-54xr-f67r-4pc4\nGHSA-x6mf-cxr9-8q6v\nImpacts:\nAll versions of the 20.x, 18.x, and 16.x release lines.\nmainModule. proto bypass experimental policy mechanism (High) (CVE-2023-30581)\nThe use of proto in process.mainModule. proto .require() can bypass the policy mechanism and require\nmodules outside of the policy.json definition.\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines:\n16.x, 18.x and, 20.x.\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js.\nThank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it.\nPath traversal bypass in experimental permission model (High) (CVE-2023-30584)\nA vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model.\nThis flaw relates to improper handling of path traversal bypass when verifying file permissions.\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nThank you, to Axel Chong for reporting this vulnerability and thank you Rafael Gonzaga for fixing it.\nInspector protocol bypass the experimental permission model (High) (CVE-2023-30587)\nA vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using\nthe built-in inspector module (node:inspector).\nBy exploiting the Worker class&#x27;s ability to create an &quot;internal worker&quot; with the kIsInternal Symbol, attackers can modify\nthe isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl.\nThis vulnerability exclusively affects Node.js users employing the permission model mechanism in Node.js 20.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nThank you, to mattaustin for reporting this vulnerability and thank you Rafael Gonzaga for fixing it.\nfs.watchFile bypass in experimental permission model (Medium) (CVE-2023-30582)\nA vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when\nthe --allow-fs-read flag is used with a non-* argument.\nThis flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API.\nAs a result, malicious actors can monitor files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nThanks to Colin Ihrig for reporting this vulnerability and to Rafael Gonzaga for fixing it.\nfs.openAsBlob bypass in experimental permission model (Medium) (CVE-2023-30583)\nfs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the\n--allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob() API.\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\nThanks to Colin Ihrig for reporting this vulnerability and to Rafael Gonzaga for fixing it.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nPrivilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) (CVE-2023-30585)\nA vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows\nusers who install Node.js using the .msi installer. This vulnerability emerges during the repair operation,\nwhere the &quot;msiexec.exe&quot; process, running under the NT AUTHORITY\\SYSTEM context, attempts to read the %USERPROFILE%\nenvironment variable from the current user&#x27;s registry.\nThe issue arises when the path referenced by the %USERPROFILE% environment variable does not exist. In such cases,\nthe &quot;msiexec.exe&quot; process attempts to create the specified path in an unsafe manner,\npotentially leading to the creation of arbitrary folders in arbitrary locations.\nThe severity of this vulnerability is heightened by the fact that the %USERPROFILE% environment variable in the Windows\nregistry can be modified by standard (or &quot;non-privileged&quot;) users.\nConsequently, unprivileged actors, including malicious entities or trojans, can manipulate the environment variable key\nto deceive the privileged &quot;msiexec.exe&quot; process.\nThis manipulation can result in the creation of folders in unintended and potentially malicious locations.\nIt is important to note that this vulnerability is specific to Windows users who install Node.js using the .msi installer.\nUsers who opt for other installation methods are not affected by this particular issue.\nThis affects all active Node.js versions: v16, v18, and, v20.\nThank you, to @sim0nsecurity for reporting this vulnerability and thank you Tobias Nießen for fixing it.\nOpenSSL engines can be used to bypass the permission model (Medium) (CVE-2023-30586)\nNode.js 20 allows loading arbitrary OpenSSL engines when the experimental permission model is enabled,\nwhich can bypass and/or disable the permission model.\nThe crypto.setEngine() API can be used to bypass the permission model when called\nwith a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process\nby manipulating the process&#x27;s stack memory to locate the permission model Permission::enabled_ in the host process&#x27;s heap memory.\nThis vulnerability affects all users using the experimental permission model in Node.js 20.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.\nThanks to Tobias Nießen for reporting this vulnerability and fixing it.\nProcess interruption due to invalid Public Key information in x509 certificates (Medium) (CVE-2023-30588)\nWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect\ntermination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing,\nas the process terminates when accessing public key info of provided certificates from user code.\nThe current context of the users will be gone, and that will cause a DoS scenario.\nThis vulnerability affects all active Node.js versions v16, v18, and, v20.\nThank you, to Marc Schönefeld for reporting this vulnerability and thank you Tobias Nießen for fixing it.\nHTTP Request Smuggling via Empty headers separated by CR (Medium) (CVE-2023-30589)\nThe llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests.\nThis can lead to HTTP Request Smuggling (HRS).\nThe CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser.\nAccording to RFC7230 section 3, only the CRLF sequence should delimit each header-field.\nThis vulnerability impacts all Node.js active versions: v16, v18, and, v20.\nThank you, to Yadhu Krishna M (Team bi0s &amp; CRED Security team) for reporting this vulnerability and thank you Paolo Insogna for fixing it.\nDiffieHellman do not generate keys after setting a private key (Medium) (CVE-2023-30590)\nThe generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys,\nthat is, it only generates a private key if none has been set yet.\nHowever, the documentation says this API call: &quot;Generates private and public Diffie-Hellman key values&quot;.\nThe documented behavior is different from the actual behavior, and this difference could easily lead to\nsecurity issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security.\nPlease note that this is a documentation change an the vulnerability has been classified under\nCWE-1068 - Inconsistency Between Implementation and Documented Design. This change applies to all\nNode.js active versions: v16, v18, and, v20.\nThanks to Ben Smyth for reporting this vulnerability and to Tobias Nießen for fixing it.\nDownloads &amp; release details\nNode.js v16.20.1 (LTS)\nNode.js v18.16.1 (LTS)\nNode.js v20.3.1 (Current)\nSummary\nThe Node.js project will release new versions of the 16.x, 18.x and 20.x\nreleases lines on or shortly after, Tuesday June 20 2023 in order to address:\n7 medium severity issues.\n3 high severity issues.\nOpenSSL security updates for which the highest vulnerability severity is Moderate. You\ncan read more about this update in the\nOpenSSL security advisory 28th March .\nOpenSSL security advisory 20th April .\nOpenSSL security advisory 30th May .\nc-ares 22th May security updates\nImpact\nThe 20.x release line of Node.js is vulnerable to 7 medium severity issues, and 3 high severity issues.\nThe 18.x release line of Node.js is vulnerable to 4 medium severity issues, and 1 high severity issues.\nThe 16.x release line of Node.js is vulnerable to 4 medium severity issues, and 1 high severity issues.\nAll the active release lines will be patched with the OpenSSL security update and c-ares security update.\nRelease timing\nReleases will be available on, or shortly after, Tuesday June 20 2023.\nContact and future updates\nPlease follow the process outlined in https://github.com/nodejs/node/security/policy if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous Wednesday August 9th 2023 Security Releases Next Thursday February 16 2023 Security Releases","summary":"Node.js 16, 18 and 20 ship fixes for ten issues, including high-severity permission-model bypasses that let code read files or load modules outside policy, and a CR-delimited HTTP request smuggling flaw in the llhttp parser. The release also updates bundled OpenSSL and c-ares, and a Windows MSI repair flaw lets unprivileged users trigger folder creation as SYSTEM.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":["16.20.1"],"affected":">= 16.0.0, < 16.20.1","ecosystem":"node"},{"name":"node","fixed":["18.16.1"],"affected":">= 18.0.0, < 18.16.1","ecosystem":"node"},{"name":"node","fixed":["20.3.1"],"affected":">= 20.0.0, < 20.3.1","ecosystem":"node"}],"ecosystems":["node"],"tags":["http-servers","node","runtime","self-hosted","windows"],"not_affected_if":["default-config","no-experimental-permission-model","non-windows"],"how_to_check":"- Run `node --version` and compare against the fixed versions: `16.20.1`, `18.16.1`, `20.3.1`.\n- If you use the experimental policy or permission model (`--experimental-permission`, `--experimental-policy`), those are the affected features.\n- Check whether a reverse proxy or load balancer sits in front of Node HTTP servers, since smuggling depends on how the front end parses requests.","fix":"- Upgrade Node.js to `16.20.1`, `18.16.1` or `20.3.1` on the matching release line.\n- Rebuild and redeploy containers or images that bundle Node so they pick up the patched OpenSSL and c-ares.\n- Reinstall Node via the patched MSI on Windows hosts that use the .msi installer.","status":"open","published_at":"2023-06-20T14:30:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:41:40+00:00","updated_at":"2026-10-25T05:41:40+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:41:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js to `16.20.1`, `18.16.1` or `20.3.1` on the matching release line.\n- Rebuild and redeploy containers or images that bundle Node so they pick up the patched OpenSSL and c-ares.\n- Reinstall Node via the patched MSI on Windows hosts that use the .msi installer.","reach":"unknown","title":"Node.js: June 2023 security releases fix bypasses, DoS and request smuggling","impact":"high","summary":"Node.js 16, 18 and 20 ship fixes for ten issues, including high-severity permission-model bypasses that let code read files or load modules outside policy, and a CR-delimited HTTP request smuggling flaw in the llhttp parser. The release also updates bundled OpenSSL and c-ares, and a Windows MSI repair flaw lets unprivileged users trigger folder creation as SYSTEM.","category":"runtime","nicknames":[],"who_cares":["node","self-hosted","windows","http-servers"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Code runs outside policy, files read past permissions, or requests smuggled","analyst_note":"Sources give no per-CVE exploit prerequisites for the llhttp smuggling or OpenSSL items; check the Node.js June 2023 blog post and linked GHSA/OpenSSL advisories for exact conditions.","how_to_check":"- Run `node --version` and compare against the fixed versions: `16.20.1`, `18.16.1`, `20.3.1`.\n- If you use the experimental policy or permission model (`--experimental-permission`, `--experimental-policy`), those are the affected features.\n- Check whether a reverse proxy or load balancer sits in front of Node HTTP servers, since smuggling depends on how the front end parses requests.","needs_analyst":true,"not_affected_if":["default-config","non-windows","no-experimental-permission-model"],"who_is_affected":"Every Node.js deployment on the 16.x, 18.x and 20.x lines is in scope because the OpenSSL and c-ares updates apply to all of them. The permission-model and policy bypasses only matter if you enable those experimental features, and the MSI repair flaw only applies to Windows installs made with the .msi package. Teams running Node behind a proxy with HTTP servers should review the request smuggling item.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001127,"input_tokens":7014,"output_tokens":851,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2023':213C,302C,391C,512C,633C '-30581':214C '-30582':513C '-30583':634C '-30584':303C '-30587':392C '16':29B,147C,201C,251C '18':30B,144C,198C,253C '20':4A,32B,142C,196C,256C,312C,345C,398C,468C,522C,590C,658C,682C '2023':5A,12A '20th':130C '23f3':179C '28th':125C '30th':135C '4pc4':185C '54xr':183C '64c2':180C '8q6v':190C '8r8p':178C '9g78':173C 'abil':425C 'access':576C 'activ':248C 'actor':565C 'advisori':124C,129C,134C,170C 'affect':238C,335C,458C,523C,580C,672C 'allow':399C,533C,652C 'allow-fs-read':532C,651C 'also':71B 'api':560C,669C 'april':131C 'are':78B,153C,162C 'argument':542C 'aris':545C,661C 'attach':445C 'attack':435C 'avail':95C,99C 'axel':279C,368C 'built':413C 'built-in':412C 'bundl':73B 'bypass':45B,207C,224C,295C,328C,384C,401C,505C,626C,637C 'c':77B,152C,161C 'c-are':76B,151C,160C 'check':665C 'chong':280C,369C 'class':423C 'code':48B 'colin':612C,685C 'constructor':449C 'cr':59B 'cr-delimit':58B 'creat':427C 'creation':90B 'cve':212C,265C,301C,353C,390C,476C,511C,598C,632C,705C 'cxr9':189C 'definit':235C 'delimit':60B 'discov':308C 'employ':461C 'es':718C 'exclus':457C 'experiment':208C,243C,272C,297C,316C,340C,361C,386C,407C,484C,507C,527C,585C,606C,628C,639C,677C,713C 'experimental-permiss':406C 'explicit':574C 'exploit':420C 'f67r':184C 'fail':552C 'featur':273C,362C,485C,607C,714C 'file':50B,331C,555C,568C,645C 'fix':34B,291C,380C,502C,623C,696C 'flag':409C,536C,655C 'flaw':64B,84B,320C,544C,660C 'folder':89B 'follow':108C,118C 'fs':534C,653C 'fs.openasblob':625C,635C,668C 'fs.watchfile':504C,559C 'ghsa':172C,177C,182C,187C 'ghsa-54xr-f67r-4pc4':181C 'ghsa-8r8p-23f3-64c2':176C 'ghsa-9g78-jv2r-p7vc':171C 'ghsa-x6mf-cxr9-8q6v':186C 'gonzaga':289C,378C,500C,621C,694C 'handl':324C 'high':40B,211C,300C,389C 'high-sever':39B 'host':26B 'http':20B,61B 'http-server':19B 'identifi':518C 'ihrig':613C,686C 'impact':137C,191C 'improp':323C 'inadequ':548C 'includ':38B,116C,159C 'initi':451C 'inspector':382C,415C,418C,443C 'intern':429C 'isintern':439C 'issu':37B,109C,267C,355C,478C,600C,707C 'june':3A,11A 'jv2r':174C 'kisintern':433C 'let':47B,85B 'line':105C,150C,204C,250C 'llhttp':67B 'load':52B 'mainmodul':205C 'malici':564C 'march':126C 'mattaustin':491C 'may':136C 'mechan':210C,227C,245C,465C 'medium':510C,631C 'miss':664C 'model':44B,299C,318C,342C,358C,388C,464C,481C,509C,529C,550C,587C,603C,630C,641C,679C,710C 'modifi':437C 'modul':53B,230C,416C 'monitor':567C 'msi':82B 'new':453C 'node':16A,17A,18A,22B,417C 'node.js':1A,28B,103C,275C,310C,344C,364C,396C,459C,467C,487C,520C,589C,609C,657C,681C,716C 'nodejs':10A 'non':541C 'note':259C,347C,470C,592C,699C 'openssl':74B,110C,119C,122C,127C,132C 'outlin':166C 'outsid':54B,231C 'p7vc':175C 'parser':68B 'path':293C,326C 'permiss':43B,298C,317C,332C,341C,357C,387C,408C,463C,480C,508C,528C,549C,586C,602C,629C,640C,678C,709C 'permission-model':42B 'pleas':258C,346C,469C,591C,698C 'polici':55B,209C,226C,244C,269C 'policy.json':234C 'privileg':717C 'process.mainmodule':220C 'proto':206C,218C,221C 'protocol':383C 'rafael':288C,377C,499C,620C,693C 'read':49B,535C,575C,647C,654C 'recent':169C 'relat':321C 'releas':7A,70B,94C,104C,115C,149C,158C,203C,249C 'releases':15A 'repair':83B 'report':282C,371C,493C,615C,688C 'request':62B 'requir':222C,229C 'restrict':402C,554C,648C 'result':563C 'runtim':23B 'secur':6A,93C,111C,114C,120C,123C,128C,133C,154C,157C,163C 'security':14A 'security-releases':13A 'self':25B 'self-host':24B 'server':21B 'set':403C 'sever':41B 'ship':33B 'smuggl':63B 'specif':313C 'support':102C 'symbol':434C 'system':92B,646C 'ten':36B 'thank':276C,286C,365C,375C,488C,497C,610C,683C 'time':263C,351C,474C,596C,703C 'travers':294C,327C 'trigger':88B 'tuesday':2A 'unprivileg':86B 'updat':72B,96C,112C,121C,155C,164C 'use':216C,241C,338C,410C,538C,583C,643C,675C 'user':87B,240C,337C,460C,524C,582C,674C 'valu':440C 'verifi':330C 'version':139C,193C,311C,397C,521C 'vnd':9A 'vnd-nodejs-june':8A 'vulner':237C,284C,305C,334C,373C,394C,456C,495C,515C,579C,617C,671C,690C 'watch':556C 'window':27B,81B 'within':314C,446C 'worker':422C,430C,448C 'workerimpl':454C 'x':143C,145C,148C,197C,199C,202C,252C,254C,257C 'x6mf':188C","nicknames":[],"mitigations":[],"who_affected":"Every Node.js deployment on the 16.x, 18.x and 20.x lines is in scope because the OpenSSL and c-ares updates apply to all of them. The permission-model and policy bypasses only matter if you enable those experimental features, and the MSI repair flaw only applies to Windows installs made with the .msi package. Teams running Node behind a proxy with HTTP servers should review the request smuggling item.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2023-06-20T14:30:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"june-2023-security-releases","url":"https://nodejs.org/en/blog/vulnerability/june-2023-security-releases","severity":"high","published_at":"2023-06-20T14:30:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T13:03:42+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}