CVE-2023-32002

Published: Aug 21, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

Affected (3)

Products: Nodejs: Node.js

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 16.0.0 to 16.20.1
Nodejs Node.js	From 18.0.0 to 18.17.0
Nodejs Node.js	From 20.0.0 to 20.5.0

Related CWEs

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (4)

https://hackerone.com/reports/1960870

Source: support@hackerone.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20230915-0009/

Source: support@hackerone.com

https://hackerone.com/reports/1960870

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20230915-0009/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.