7.5
High
CVE-2023-30586 A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the…
Description
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process's stack memory to locate the permission model Permission::enabled_ in the host process's heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 20.0 | 20.0 → < 20.3.1 | 20.3.1 |
| Node 19.0 | 19.0 → latest | No fix stated |
| Node 17.0 | 17.0 → latest | No fix stated |
| Node 15.0 | 15.0 → latest | No fix stated |
| Node 14.0 | 14.0 → latest | No fix stated |
| Node 13.0 | 13.0 → latest | No fix stated |
| Node 12.0 | 12.0 → latest | No fix stated |
| Node 11.0 | 11.0 → latest | No fix stated |
| Node 10.0 | 10.0 → latest | No fix stated |
Show the 6 other branches Hide the 6 other branches
References
- hackerone.com hackerone.com
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified
Other CVEs of Node
The 129 CVEs of Node →
CVE-2026-106069
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP…
7.4
High
CVE-2026-105482
A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*()…
7.4
High
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Medium
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a…
7.4
High