{"id":"VND-nodejs-openssl-fixes-in-regular-releases-oct2023","kind":"vulnerability","aliases":[],"related":["CVE-2023-4807","CVE-2023-5363"],"title":"Node.js: OpenSSL Recent Security Patches","description":"Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners OpenSSL Recent Security Patches RG Rafael Gonzaga OpenSSL Recent Security Patches Summary\nFor the vulnerabilities disclosed in the OpenSSL Security Advisories of:\nOpenSSL 3.0.11 - Tuesday 19th September 2023\nOpenSSL 3.0.12 - Tuesday 24th October 2023\nNode.js (Windows) is affected by one vulnerability rated as LOW.\nTherefore, these patches will be released in regular Node.js releases.\nAnalysis\nOur assessment of the following security advisories:\nOpenSSL 3.0.11\nOpenSSL 3.0.12\nis:\nPOLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807) - Low\nNode.js is affected by this vulnerability. The CVE-2023-4807\naffects Windows users, and the vulnerability is rated as LOW by the OpenSSL\nSecurity Team.\nIncorrect cipher key & IV length processing (CVE-2023-5363) - Moderate\nNode.js doesn't make use or export EVP_EncryptInit_ex2() , EVP_DecryptInit_ex2() or\nEVP_CipherInit_ex2() functions. Node.js is not affected.\nUsers who call the affected OpenSSL functions through other means,\nsuch as through native addons, can dynamically link against a patched version of OpenSSL\nuntil new releases of Node.js are available.\nContact and future updates\nThe current Node.js security policy can be found at https://github.com/nodejs/node/security/policy#security ,\nincluding information on how to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at\nhttps://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on\nsecurity vulnerabilities and security-related releases of Node.js and the\nprojects maintained in the\nnodejs GitHub organization . Previous Wednesday February 14 2024 Security Releases Next Friday October 13 2023 Security Releases","summary":"Node.js bundles OpenSSL, and OpenSSL 3.0.11 and 3.0.12 fixed CVE-2023-4807, where the POLY1305 MAC implementation corrupts XMM registers on Windows. Node.js rates the flaw LOW and ships the fix in regular Node.js releases; the Node.js team says CVE-2023-5363 does not affect it because Node.js does not use the affected functions.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":[],"affected":"","ecosystem":"node"}],"ecosystems":["node"],"tags":["node","runtime","windows"],"not_affected_if":["linux-only","macos-only","no-native-addons-calling-openssl"],"how_to_check":"- Run `node --version` and compare it with the fixed release listed in the Node.js advisory.\n- Run `node -p process.versions.openssl` to see the bundled OpenSSL version.\n- Check whether native addons call EVP_EncryptInit_ex2, EVP_DecryptInit_ex2 or EVP_CipherInit_ex2 directly.","fix":"- Upgrade Node.js on Windows to a regular release that includes OpenSSL 3.0.12 or later, once it is published.\n- Native addons that call the affected OpenSSL functions can link against a patched system OpenSSL until a new Node.js release is available.","status":"open","published_at":"2023-10-26T17:00:15+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:41:35+00:00","updated_at":"2026-10-25T05:41:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:41:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js on Windows to a regular release that includes OpenSSL 3.0.12 or later, once it is published.\n- Native addons that call the affected OpenSSL functions can link against a patched system OpenSSL until a new Node.js release is available.","reach":"unknown","title":"Node.js on Windows: OpenSSL POLY1305 flaw corrupts XMM registers","impact":"low","summary":"Node.js bundles OpenSSL, and OpenSSL 3.0.11 and 3.0.12 fixed CVE-2023-4807, where the POLY1305 MAC implementation corrupts XMM registers on Windows. Node.js rates the flaw LOW and ships the fix in regular Node.js releases; the Node.js team says CVE-2023-5363 does not affect it because Node.js does not use the affected functions.","category":"runtime","nicknames":[],"who_cares":["node","windows"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Corrupted XMM registers can cause incorrect results or crashes in Node.js on Windows.","analyst_note":"Confirm which Node.js release first ships OpenSSL 3.0.12 on Windows and whether the advisory covers exploitation beyond crashes; check the linked Node.js release notes.","how_to_check":"- Run `node --version` and compare it with the fixed release listed in the Node.js advisory.\n- Run `node -p process.versions.openssl` to see the bundled OpenSSL version.\n- Check whether native addons call EVP_EncryptInit_ex2, EVP_DecryptInit_ex2 or EVP_CipherInit_ex2 directly.","needs_analyst":true,"not_affected_if":["linux-only","macos-only","no-native-addons-calling-openssl"],"who_is_affected":"Only Node.js installations on Windows are affected, because the flaw corrupts XMM registers in the Windows build of the POLY1305 code. Linux and macOS installs are not listed as affected. Teams whose Node.js runs only on Linux or macOS can treat this as informational.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000776,"input_tokens":3971,"output_tokens":758,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2023':29B,59B,167C,178C,202C '-4807':30B,168C,179C '-5363':60B,203C '/forum/#!forum/nodejs-sec':301C '/nodejs/node/security/policy#security':273C '13':336C '14':329C '19th':116C '2023':118C,124C,337C '2024':330C '24th':122C '3.0.11':24B,114C,154C '3.0.12':26B,120C,156C 'addon':241C 'advisori':111C,152C 'affect':63B,71B,128C,172C,180C,226C,231C 'analysi':145C 'announc':291C 'announcement-on':290C 'assess':147C 'avail':83C,257C 'bundl':20B 'call':229C 'cipher':196C 'cipherinit':220C 'commerci':73C 'contact':258C 'corrupt':36B,161C 'current':263C 'cve':28B,58B,166C,177C,201C 'date':306C 'decryptinit':216C 'disclos':106C 'doesn':206C 'dynam':243C 'ecosystem':87C 'encryptinit':213C 'evp':212C,215C,219C 'ex2':214C,217C,221C 'export':211C 'februari':328C 'fix':27B,49B 'fixes':10A 'flaw':44B 'follow':150C 'found':269C 'friday':334C 'function':72B,222C,233C 'futur':260C 'github':324C 'github.com':272C 'github.com/nodejs/node/security/policy#security':271C 'gonzaga':97C 'groups.google.com':300C 'groups.google.com/forum/#!forum/nodejs-sec':299C 'implement':35B,160C 'in':11A 'includ':274C 'incorrect':195C 'inform':275C 'iv':198C 'key':197C 'length':199C 'link':244C 'list':297C 'low':45B,134C,169C,189C,288C 'low-volum':287C 'lts':80C 'mac':34B,159C 'mail':296C 'maintain':320C 'mainten':79C 'make':208C 'mean':236C 'moder':204C 'nativ':240C 'new':252C 'next':333C 'node':15A,16B 'node.js':1A,19B,41B,52B,55B,66B,125C,143C,170C,205C,223C,255C,264C,283C,316C 'nodej':294C,323C 'nodejs':8A 'nodejs-sec':293C 'oct2023':14A 'octob':123C,335C 'one':130C 'openj':86C 'openssl':2A,9A,21B,23B,91C,98C,109C,113C,119C,153C,155C,192C,232C,250C 'organ':325C 'partner':90C 'past':77C 'patch':5A,94C,101C,137C,247C 'phase':81C 'polici':266C 'poly1305':33B,158C 'previous':326C 'process':200C 'program':89C 'project':319C 'rafael':96C 'rate':42B,132C,187C 'recent':3A,92C,99C 'regist':38B,163C 'regular':12A,51B,142C 'relat':313C 'releas':53B,140C,144C,253C,314C,332C,339C 'releases':13A 'report':279C 'rg':95C 'runtim':17B 'say':57B 'sec':295C 'secur':4A,93C,100C,110C,151C,193C,265C,308C,312C,331C,338C 'security-rel':311C 'septemb':117C 'ship':47B 'stay':303C 'subscrib':284C 'summari':102C 'support':74C 'sustain':88C 'team':56B,194C 'therefor':135C 'tuesday':115C,121C 'updat':261C 'use':69B,209C 'user':182C,227C 'version':76C,248C 'vnd':7A 'vnd-nodejs-openssl-fixes-in-regular-releases-oct2023':6A 'volum':289C 'vulner':105C,131C,175C,185C,281C,309C 'wednesday':327C 'window':18B,40B,126C,165C,181C 'xmm':37B,162C","nicknames":[],"mitigations":[],"who_affected":"Only Node.js installations on Windows are affected, because the flaw corrupts XMM registers in the Windows build of the POLY1305 code. Linux and macOS installs are not listed as affected. Teams whose Node.js runs only on Linux or macOS can treat this as informational.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2023-10-26T17:00:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"openssl-fixes-in-regular-releases-oct2023","url":"https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-oct2023","severity":"low","published_at":"2023-10-26T17:00:15+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T23:18:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}