CVE-2023-39332
Fixed in a distro release EPSS 2%
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects. This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux 8 | nodejs-devel | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux 8 | nodejs-docs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux 8 | nodejs-full-i18n | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux 8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux 8 | npm | 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 |
| Chainguard | nodejs-16 | 0 |
| Chainguard | nodejs-18 | 0 |
| Chainguard | nodejs-20 | 20.8.0-r0 |
| Red Hat Enterprise Linux 8 | nodejs | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat Enterprise Linux 8 | npm | 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824 |
| Rocky Linux 8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 |
| Rocky Linux 8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
| Wolfi | nodejs-16 | 0 |
| Wolfi | nodejs-18 | 0 |
| Wolfi | nodejs-20 | 20.8.0-r0 |
| openSUSE Tumbleweed | nodejs20 | 20.8.1-1.1 |