{"id":"VND-nodejs-october-2023-security-releases","kind":"vulnerability","aliases":[],"related":["CVE-2023-30584","CVE-2023-32004","CVE-2023-38552","CVE-2023-39331","CVE-2023-39332","CVE-2023-39333","CVE-2023-44487","CVE-2023-45143","GHSA-wqq4-5wpv-mx2g"],"title":"Node.js: Friday October 13 2023 Security Releases","description":"Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners Friday October 13 2023 Security Releases RG Rafael Gonzaga Friday October 13 2023 Security Releases (Update 13-October-2023) Security releases available\nUpdates are now available for the v18.x and v20.x Node.js release lines for the\nfollowing issues.\nundici - Cookie headers are not cleared in cross-domain redirect in undici-fetch (Low) - (CVE-2023-45143)\nUndici did not always clear Cookie headers on cross-origin redirects. By design, cookie headers are forbidden request headers , disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici&#x27;s implementation of fetch.\nAs such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (i.e. an open redirector) to leak the cookie to the 3rd party site.\nMore details area available in GHSA-wqq4-5wpv-mx2g\nnghttp2 - HTTP/2 Rapid Reset (High) - (CVE-2023-44487)\nRapidly creating and cancelling streams ( HEADERS frame immediately followed by RST_STREAM ) without bound causes denial of service.\nSee https://www.cve.org/CVERecord?id=CVE-2023-44487 for details.\nImpacts:\nThis vulnerability affects all users of HTTP/2 servers in all active\nrelease lines 18.x and 20.x.\nPermission model improperly protects against path traversal (High) - (CVE-2023-39331)\nA previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently.\nThe new path traversal vulnerability arises because the implementation does not protect itself against the application\noverwriting built-in utility functions with user-defined implementations.\nImpacts:\nThis vulnerability affects all users using the experimental permission model in Node.js 20.x.\nPlease note that at the time this CVE is issued, the permission model is an experimental feature of Node.js.\nThanks to Tobias Nießen who reported and created\nthe security patch.\nPath traversal through path stored in Uint8Array (High) - (CVE-2023-39332)\nVarious node:fs functions allow specifying paths as either strings or Uint8Array objects.\nIn Node.js environments, the Buffer class extends the Uint8Array class.\nNode.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004),\nbut not through non- Buffer Uint8Array objects.\nThis is distinct from CVE-2023-32004 ( report 2038134 ),\nwhich only referred to Buffer objects. However, the vulnerability follows the same pattern using Uint8Array instead of Buffer .\nImpacts:\nThis vulnerability affects all users using the experimental permission model in Node.js 20.x.\nPlease note that at the time this CVE is issued, the permission model is an experimental feature of Node.js.\nThanks to Tobias Nießen who reported and created\nthe security patch.\nIntegrity checks according to policies can be circumvented (Medium) - (CVE-2023-38552)\nWhen the Node.js policy feature checks the integrity of a resource against a trusted manifest,\nthe application can intercept the operation and return a forged checksum to node&#x27;s policy implementation,\nthus effectively disabling the integrity check.\nImpacts:\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x.\nPlease note that at the time this CVE is issued, the policy mechanism is an experimental feature of Node.js.\nThanks to Tobias Nießen who reported and created\nthe security patch.\nCode injection via WebAssembly export names (Low) - (CVE-2023-39333)\nMaliciously crafted export names in an imported WebAssembly module can inject JavaScript code.\nThe injected code may be able to access data and functions that the WebAssembly module itself does not have access to,\nsimilar to as if the WebAssembly module was a JavaScript module.\nImpacts:\nThis vulnerability affects users of the --experimental-wasm-modules command line option in all active release lines 18.x and 20.x.\nThanks to dittyroma for reporting the issue and to Tobias Nießen for fixing it.\nDownloads and release details\nNode.js v20.8.1 (Current)\nNode.js v18.18.2 (LTS)\nSummary\nThe Node.js project will release new versions of the 18.x and 20.x\nreleases lines on or shortly after, Friday October 13 2023 in order to address:\n2 high severity issues.\n1 medium severity issue.\n1 low severity issue.\nundici October security updates\nnghttp2 October security updates\nImpact\nAll the active release lines are affected by undici and nghttp2 security patches, which are rated as high severity issues.\nIn addition, the 20.x release line of Node.js is vulnerable to 2 high severity issues, 1 medium severity issue, and 1 low severity issue.\nIn addition, the 18.x release line of Node.js is vulnerable to 1 medium severity issue, and 1 low severity issue.\nRelease timing\nReleases will be available on, or shortly after, Friday October 13 2023.\nContact and future updates\nPlease follow the process outlined in https://github.com/nodejs/node/security/policy if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous OpenSSL Recent Security Patches Next Wednesday August 9th 2023 Security Releases","summary":"Node.js 18.x and 20.x have several flaws, the worst being an HTTP/2 Rapid Reset denial of service through nghttp2 and path traversal in the experimental permission model. An attacker can crash HTTP/2 servers or read and write files outside the paths the permission model is meant to allow.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":["18.18.2"],"affected":">= 18.0.0, < 18.18.2","ecosystem":"node"},{"name":"node","fixed":["20.8.1"],"affected":">= 20.0.0, < 20.8.1","ecosystem":"node"}],"ecosystems":["node"],"tags":["http2-servers","node","node.js","nodejs-18","nodejs-20","runtime","self-hosted"],"not_affected_if":["experimental-features-off","no-http2-server","node-below-18"],"how_to_check":"- Run `node --version` and compare against the fixed releases `18.18.2` and `20.8.1`.\n- Check whether any HTTP/2 server runs on Node.js with `node --version` output for 18.x or 20.x.\n- Check whether `--experimental-permission` or `--experimental-policy` is passed to Node.js in startup scripts.\n- Check whether `--experimental-wasm-modules` is enabled.","fix":"- Upgrade Node.js 18.x to `18.18.2` or later.\n- Upgrade Node.js 20.x to `20.8.1` or later.\n- Rebuild or redeploy any container images that bundle Node.js.","status":"open","published_at":"2023-10-13T13:30:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:41:35+00:00","updated_at":"2026-10-25T05:41:36+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-25T05:41:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js 18.x to `18.18.2` or later.\n- Upgrade Node.js 20.x to `20.8.1` or later.\n- Rebuild or redeploy any container images that bundle Node.js.","reach":"internet","title":"Node.js: October 2023 releases fix HTTP/2 Rapid Reset and path traversal flaws","impact":"medium","summary":"Node.js 18.x and 20.x have several flaws, the worst being an HTTP/2 Rapid Reset denial of service through nghttp2 and path traversal in the experimental permission model. An attacker can crash HTTP/2 servers or read and write files outside the paths the permission model is meant to allow.","category":"runtime","nicknames":["HTTP/2 Rapid Reset"],"who_cares":["node.js","http2-servers","self-hosted","nodejs-18","nodejs-20"],"confidence":0.8,"needs_auth":"unknown","worst_case":"HTTP/2 servers can be crashed; permission-model users can read or write outside allowed paths","analyst_note":"Confirm the undici cookie leak scope and whether the high-severity path issues apply outside the experimental permission model, using the GHSA-wqq4-5wpv-mx2g advisory and the CVE records.","how_to_check":"- Run `node --version` and compare against the fixed releases `18.18.2` and `20.8.1`.\n- Check whether any HTTP/2 server runs on Node.js with `node --version` output for 18.x or 20.x.\n- Check whether `--experimental-permission` or `--experimental-policy` is passed to Node.js in startup scripts.\n- Check whether `--experimental-wasm-modules` is enabled.","needs_analyst":true,"not_affected_if":["no-http2-server","experimental-features-off","node-below-18"],"who_is_affected":"All users of Node.js 18.x and 20.x running HTTP/2 servers are exposed to the nghttp2 Rapid Reset denial of service, which the sources say affects all active release lines. The path traversal and policy-bypass flaws only matter for applications that use the experimental permission model, the experimental policy mechanism, or a server reachable by untrusted input. Teams running only older Node.js releases or not using these features can skip the file-path and policy items.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000938,"input_tokens":5247,"output_tokens":827,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-18':27B '-20':29B '-2023':120C,157C,269C,323C,330C,416C,449C,456C,470C,547C,645C '-30584':331C,450C '-32004':457C,471C '-38552':548C '-39331':324C '-39332':417C '-39333':646C '-44487':270C '-45143':158C '/cverecord?id=cve-2023-44487':292C '13':4A,104C,113C,118C '18':35B,309C,602C '20':38B,312C,375C,505C,605C '2023':5A,12A,105C,114C '2038134':473C '3rd':227C,250C '3rd-party':226C '5wpv':261C 'abl':665C 'access':667C,679C 'accident':220C 'accord':539C 'activ':306C,599C 'affect':298C,365C,495C,589C 'allow':83B,422C 'alway':162C 'applic':350C,565C 'area':255C 'aris':340C 'assumpt':204C 'attack':64B,233C 'avail':94C,123C,127C,256C 'bound':284C 'browser':187C 'buffer':435C,452C,462C,478C,491C 'built':353C 'built-in':352C 'cancel':274C 'caus':285C 'check':538C,554C,585C 'checksum':574C 'circumv':544C 'class':436C,440C 'clear':145C,163C 'code':637C,659C,662C 'commerci':84C 'control':236C 'cooki':141C,164C,173C,223C,247C 'craft':648C 'crash':66B 'creat':272C,403C,533C,633C 'cross':148C,168C 'cross-domain':147C 'cross-origin':167C 'cve':156C,268C,322C,329C,384C,415C,448C,455C,469C,514C,546C,614C,644C 'data':668C 'defin':360C 'denial':50B,286C 'design':172C 'detail':254C,294C 'disabl':582C 'disallow':179C 'disclos':327C 'disconnect':201C 'distinct':467C 'domain':149C 'ecosystem':98C 'effect':581C 'either':426C 'environ':188C,433C 'experiment':60B,370C,392C,500C,522C,594C,622C 'export':641C,649C 'extend':437C 'featur':393C,523C,553C,623C 'fetch':154C,213C 'file':73B 'flaw':42B 'follow':138C,279C,483C 'forbidden':176C 'forg':573C 'frame':277C 'friday':2A,102C,111C 'fs':420C 'function':356C,421C,670C 'ghsa':259C 'ghsa-wqq4-5wpv-mx2g':258C 'gonzaga':110C 'handl':191C 'header':142C,165C,174C,178C,192C,276C 'high':267C,321C,414C 'host':33B 'howev':480C 'http/2':16A,47B,67B,264C,302C 'http2':22B 'http2-servers':21B 'i.e':240C 'immedi':278C 'impact':295C,362C,492C,586C,692C 'implement':211C,343C,361C,579C 'import':653C 'improp':316C 'inject':638C,657C,661C 'instead':489C 'insuffici':334C 'integr':537C,556C,584C 'intercept':567C 'issu':139C,386C,516C,616C 'javascript':658C,690C 'lead':218C 'leak':245C 'leakag':221C 'liber':194C 'line':135C,308C,601C 'low':155C,643C 'lts':91C 'made':207C 'mainten':90C 'malici':232C,647C 'manifest':563C 'may':217C,663C 'meant':81B 'mechan':596C,619C 'medium':545C 'model':62B,79B,315C,372C,389C,502C,519C 'modul':655C,674C,687C,691C 'mx2g':262C 'name':642C,650C 'new':336C 'nghttp2':54B,263C 'nießen':399C,529C,629C 'node':19A,20A,24B,419C,576C 'node.js':1A,25B,34B,133C,374C,395C,432C,441C,504C,525C,551C,625C 'nodej':26B,28B 'nodejs':10A 'non':461C 'note':378C,508C,608C 'object':430C,453C,464C,479C 'octob':3A,103C,112C,119C 'october':11A 'open':242C 'openj':97C 'oper':569C 'origin':169C 'outsid':74B 'overwrit':351C 'parti':228C,251C 'partner':101C 'past':88C 'patch':333C,406C,536C,636C 'path':56B,76B,319C,337C,407C,410C,424C,443C 'pattern':486C 'permiss':61B,78B,314C,371C,388C,501C,518C 'phase':92C 'pleas':377C,507C,607C 'polici':541C,552C,578C,595C,618C 'prevent':442C 'previous':326C 'program':100C 'protect':317C,346C 'rafael':109C 'rapid':17A,48B,265C,271C 'read':70B 'redirect':150C,170C,238C 'redirector':243C 'refer':476C 'releas':7A,107C,116C,122C,134C,307C,600C 'releases':15A 'report':401C,472C,531C,631C 'request':177C 'requestinit.headers':185C 'reset':18A,49B,266C 'resourc':559C 'return':571C 'rg':108C 'rst':281C 'runtim':30B 'secur':6A,106C,115C,121C,405C,535C,635C 'security':14A 'security-releases':13A 'see':289C,447C,454C 'self':32B 'self-host':31B 'server':23B,68B,303C 'servic':52B,288C 'set':183C 'sever':41B 'similar':681C 'sinc':189C 'site':229C,252C 'spec':197C,206C 'specifi':423C 'store':411C 'stream':275C,282C 'string':427C,446C 'support':85C 'sustain':99C 'target':239C 'thank':396C,526C,626C 'thus':580C 'time':382C,512C,612C 'tobia':398C,528C,628C 'travers':57B,320C,338C,408C,444C 'trust':562C 'uint8array':413C,429C,439C,463C,488C 'undici':140C,153C,159C,190C,209C 'undici-fetch':152C 'updat':117C,124C 'use':368C,487C,498C,592C 'user':300C,359C,367C,497C,591C 'user-defin':358C 'util':355C 'v18.x':130C 'v20.x':132C 'various':418C 'version':87C 'via':639C 'vnd':9A 'vnd-nodejs-october':8A 'vulner':297C,328C,339C,364C,482C,494C,588C 'vulnerabili':694C 'webassembl':640C,654C,673C,686C 'without':283C 'worst':44B 'wqq4':260C 'write':72B 'www.cve.org':291C 'www.cve.org/cverecord?id=cve-2023-44487':290C 'x':36B,39B,310C,313C,376C,506C,603C,606C","nicknames":["HTTP/2 Rapid Reset"],"mitigations":[],"who_affected":"All users of Node.js 18.x and 20.x running HTTP/2 servers are exposed to the nghttp2 Rapid Reset denial of service, which the sources say affects all active release lines. The path traversal and policy-bypass flaws only matter for applications that use the experimental permission model, the experimental policy mechanism, or a server reachable by untrusted input. Teams running only older Node.js releases or not using these features can skip the file-path and policy items.","tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2023-10-13T13:30:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"october-2023-security-releases","url":"https://nodejs.org/en/blog/vulnerability/october-2023-security-releases","severity":"high","published_at":"2023-10-13T13:30:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T21:27:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}