Vulnerability · Published Oct 18, 2023 · Assigned by hackerone
CVE-2023-39332
Critical 9.8
In plain English
A critical-severity security flaw in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects. This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux:8 | nodejs-devel | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux:8 | nodejs-docs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux:8 | nodejs-full-i18n | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2023:7205 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2023:7205 |
| AlmaLinux:8 | npm | 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| Alpine:v3.20 | nodejs-current | 20.8.1-r0 | ALPINE-CVE-2023-39332 |
| Alpine:v3.21 | nodejs-current | 20.8.1-r0 | ALPINE-CVE-2023-39332 |
| Alpine:v3.22 | nodejs-current | 20.8.1-r0 | ALPINE-CVE-2023-39332 |
| Alpine:v3.23 | nodejs-current | 20.8.1-r0 | ALPINE-CVE-2023-39332 |
| Alpine:v3.24 | nodejs-current | 20.8.1-r0 | ALPINE-CVE-2023-39332 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2023:7205 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2023:7205 |