Live › vulnerability › VND-nodejs-openssl-fixes-in-regular-releases-oct2023
Go to dashboardNode.js bundles OpenSSL, and OpenSSL 3.0.11 and 3.0.12 fixed CVE-2023-4807, where the POLY1305 MAC implementation corrupts XMM registers on Windows. Node.js rates the flaw LOW and ships the fix in regular Node.js releases; the Node.js team says CVE-2023-5363 does not affect it because Node.js does not use the affected functions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
Only Node.js installations on Windows are affected, because the flaw corrupts XMM registers in the Windows build of the POLY1305 code. Linux and macOS installs are not listed as affected. Teams whose Node.js runs only on Linux or macOS can treat this as informational.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| node | node | – | – |
node --version and compare it with the fixed release listed in the Node.js advisory.node -p process.versions.openssl to see the bundled OpenSSL version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners OpenSSL Recent Security Patches RG Rafael Gonzaga OpenSSL Recent Security Patches Summary For the vulnerabilities disclosed in the OpenSSL Security Advisories of: OpenSSL 3.0.11 - Tuesday 19th September 2023 OpenSSL 3.0.12 - Tuesday 24th October 2023 Node.js (Windows) is affected by one vulnerability rated as LOW. Therefore, these patches will be released in regular Node.js releases. Analysis Our assessment of the following security advisories: OpenSSL 3.0.11 OpenSSL 3.0.12 is: POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807) - Low Node.js is affected by this vulnerability. The CVE-2023-4807 affects Windows users, and the vulnerability is rated as LOW by the OpenSSL Security Team. Incorrect cipher key & IV length processing (CVE-2023-5363) - Moderate Node.js doesn't make use or export EVP_EncryptInit_ex2() , EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() functions. Node.js is not affected. Users who call the affected OpenSSL functions through other means, such as through native addons, can dynamically link against a patched version of OpenSSL until new releases of Node.js are available. Contact and future updates The current Node.js security policy can be found at https://github.com/nodejs/node/security/policy#security , including information on how to report a vulnerability in Node.js. Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization . Previous Wednesday February 14 2024 Security Releases Next Friday October 13 2023 Security Releases
This page as .md · .json · in your agent: get_signal("VND-nodejs-openssl-fixes-in-regular-releases-oct2023")