CVE-2023-39331
Fixed in a distro release EPSS 2%CVSS 7.7
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux 8 | nodejs-devel | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux 8 | nodejs-docs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux 8 | nodejs-full-i18n | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | npm | 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 |
| Chainguard | nodejs-16 | 0 |
| Chainguard | nodejs-16-doc | 0 |
| Chainguard | nodejs-18 | 0 |
| Chainguard | nodejs-18-doc | 0 |
| Chainguard | nodejs-19 | 0 |
| Chainguard | nodejs-20 | 20.8.0-r0 |
| Chainguard | nodejs-20-doc | 20.8.0-r0 |
| Red Hat Enterprise Linux 8 | nodejs | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | npm | 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824 |
| Rocky Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 |
| Rocky Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
| Ubuntu 20.04 LTS | nodejs | no fix |
| Ubuntu 22.04 LTS | nodejs | no fix |
| Ubuntu 24.04 LTS | nodejs | no fix |
| Ubuntu 24.10 | nodejs | no fix |
| Ubuntu 25.04 | nodejs | no fix |
| Ubuntu Pro 14.04 LTS | nodejs | no fix |
| Ubuntu Pro 16.04 LTS | nodejs | no fix |
| Ubuntu Pro 18.04 LTS | nodejs | no fix |
| Wolfi | nodejs-16 | 0 |
| Wolfi | nodejs-16-doc | 0 |
| Wolfi | nodejs-18 | 0 |
| Wolfi | nodejs-18-doc | 0 |
| Wolfi | nodejs-19 | 0 |
| Wolfi | nodejs-20 | 20.8.0-r0 |
| Wolfi | nodejs-20-doc | 20.8.0-r0 |
| openSUSE Tumbleweed | nodejs20 | 20.8.1-1.1 |