A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6.
A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
- Published
- Oct 18, 2023
- Updated
- Jun 17, 2026
- EPSS
- 1.3% · 70th percentile
- CWE
- CWE-22
Sign in to follow · You’ll be notified if a followed record enters KEV, gets an exploit or is updated.
Report tools
Action score
30
Monitor
Low priority for now.
- CVSS
- 30 / 40 · 7.5 / 10
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 1.3%
CISA SSVC decision
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
Vulnrichment: CISA's decision-tree inputs.
CNA vs NVD score
- NVD
- 7.5
- CNA · hackerone
- 7.7
- 0.2 point gap
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The score given by the assigning authority versus NVD’s independent score. A gap means the severity is contested.
Noroxi analysis
No Noroxi analysis for this record yet
We don't hand-write analysis for the hundreds of thousands of vulnerabilities in the database; that wouldn't be honest. For notable, high-impact vulnerabilities our team writes the mechanism, detection and remediation steps.
We use this product, ask for helpAffected systems
| Vendor | Product | CPE |
|---|---|---|
| nodejs | node.js | cpe:2.3:a:nodejs:node.js |
Using node.js? Add it to your stack and be the first to know about CVEs like this one. (Node.js)
Affected versions
NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.
- nodejs node.js20.0.0 and later · before 20.8.1
Versions reported by the vendor
Affected version ranges reported by the assigning authority (hackerone). Independent of NVD's CPE analysis and usually ahead of it.
NodeJS Node
- 4.0 and later · before 4.*affected · semver
- 5.0 and later · before 5.*affected · semver
- 6.0 and later · before 6.*affected · semver
- 7.0 and later · before 7.*affected · semver
- 8.0 and later · before 8.*affected · semver
- 9.0 and later · before 9.*affected · semver
- 10.0 and later · before 10.*affected · semver
- 11.0 and later · before 11.*affected · semver
- 12.0 and later · before 12.*affected · semver
- 13.0 and later · before 13.*affected · semver
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| AlmaLinux:8 | nodejs | before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux:8 | nodejs-devel | before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux:8 | nodejs-docs | before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux:8 | nodejs-full-i18n | before 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux:8 | nodejs-nodemon | before 3.0.1-1.module_el8.9.0+3675+0258a6d9 | 3.0.1-1.module_el8.9.0+3675+0258a6d9 |
| AlmaLinux:8 | nodejs-packaging | before 2021.06-4.module_el8.9.0+3684+11b9e959 | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux:8 | nodejs-packaging-bundler | before 2021.06-4.module_el8.9.0+3684+11b9e959 | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| AlmaLinux:8 | npm | before 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 | 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 |
| openSUSE:Tumbleweed | nodejs20 | before 20.8.1-1.1 | 20.8.1-1.1 |
| Red Hat:enterprise_linux:8::appstream | nodejs | before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat:enterprise_linux:8::appstream | nodejs-debuginfo | before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat:enterprise_linux:8::appstream | nodejs-debugsource | before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat:enterprise_linux:8::appstream | nodejs-devel | before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat:enterprise_linux:8::appstream | nodejs-docs | before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat:enterprise_linux:8::appstream | nodejs-full-i18n | before 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat:enterprise_linux:8::appstream | nodejs-nodemon | before 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 | 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 |
| Red Hat:enterprise_linux:8::appstream | nodejs-packaging | before 0:2021.06-4.module+el8.9.0+19519+e25b965a | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat:enterprise_linux:8::appstream | nodejs-packaging-bundler | before 0:2021.06-4.module+el8.9.0+19519+e25b965a | 0:2021.06-4.module+el8.9.0+19519+e25b965a |
| Red Hat:enterprise_linux:8::appstream | npm | before 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824 | 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824 |
| Rocky Linux:8 | nodejs-nodemon | before 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 |
| Rocky Linux:8 | nodejs-packaging | before 0:2021.06-4.module+el8.7.0+1072+5b168780 | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
Same product
nodejs: all recordsOther highest-scoring records for the same primary product.
- CVE-2019-15605HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed56Plan
- CVE-2021-22883Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 52Plan
- CVE-2021-22930Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory c50Plan
- CVE-2021-22931Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation46Plan
- CVE-2020-8277A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versi46Plan
- CVE-2017-14849Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the p46Plan
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| NodeJS Node | 10.* | Vendor (CNA) |
| NodeJS Node | 11.* | Vendor (CNA) |
| NodeJS Node | 12.* | Vendor (CNA) |
| NodeJS Node | 13.* | Vendor (CNA) |
| NodeJS Node | 14.* | Vendor (CNA) |
| NodeJS Node | 15.* | Vendor (CNA) |
| NodeJS Node | 16.* | Vendor (CNA) |
| NodeJS Node | 17.* | Vendor (CNA) |
| NodeJS Node | 19.* | Vendor (CNA) |
| NodeJS Node | 20.8.1 | Vendor (CNA) |
| NodeJS Node | 4.* | Vendor (CNA) |
| NodeJS Node | 5.* | Vendor (CNA) |
| NodeJS Node | 6.* | Vendor (CNA) |
| NodeJS Node | 7.* | Vendor (CNA) |
| NodeJS Node | 8.* | Vendor (CNA) |
| NodeJS Node | 9.* | Vendor (CNA) |
| almalinux:nodejs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:nodejs-devel | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:nodejs-docs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:nodejs-full-i18n | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:nodejs-nodemon | 3.0.1-1.module_el8.9.0+3675+0258a6d9 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 · AlmaLinux:8 | Package registry (OSV) |
| almalinux:npm | 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 · AlmaLinux:8 | Package registry (OSV) |
| opensuse:nodejs20 | 20.8.1-1.1 · openSUSE:Tumbleweed | Package registry (OSV) |
| red hat:nodejs | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 · Red Hat:enterprise_linux:8::appstream | Package registry (OSV) |
| red hat:nodejs-debuginfo | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 · Red Hat:enterprise_linux:8::appstream | Package registry (OSV) |
| red hat:nodejs-debugsource | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 · Red Hat:enterprise_linux:8::appstream | Package registry (OSV) |
| red hat:nodejs-devel | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 · Red Hat:enterprise_linux:8::appstream | Package registry (OSV) |
| red hat:nodejs-docs | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 · Red Hat:enterprise_linux:8::appstream | Package registry (OSV) |
+7
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
No dated events beyond publication.
FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).
Patch and commit links
Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.
No commit or PR link among the references.
Credits
All researchersFinders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.
No credits in the CNA record.
Variant candidates
Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.
- CVE-2023-393320 days apartVarious `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects.40Plan
- CVE-2023-3200464 days apartA vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model.36Monitor
- CVE-2024-21891124 days apartNode.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-d35Monitor
- CVE-2023-3255837 days apartThe use of the deprecated API `process.binding()` can bypass the permission model through path traversal.31Monitor
- CVE-2025-23084468 days apartA vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment.22Monitor
- CVE-2023-3200364 days apart`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack.21Monitor
Chain candidates
An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.
—
Bug bounty scope
The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.
Technical details
Attack conditions
- Anyone who can reach it over the internet can trigger it.
- No account or password is required.
- No user action is required.
- No special conditions are required; it is repeatable.
If successful
- Confidentiality
- none
- Integrity
- high · data or configuration can be modified
- Availability
- none
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- None
- Integrity impact
- High
- Availability impact
- None
Weakness class (CWE)
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd-primary
Root cause
A user-supplied file name is joined with the allowed directory, but the result is never checked to confirm it is still inside that directory.
The bug in code
The whole CWE-22 classA representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.
Vulnerable
const file = path.join(ROOT, req.query.name);res.sendFile(file);Fixed
const file = path.resolve(ROOT, req.query.name);if (!file.startsWith(ROOT + path.sep)) { return res.sendStatus(400);}res.sendFile(file);Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
Attack patterns (CAPEC)
- Path TraversalCAPEC-126likelihood: High · Very High
- Using Slashes and URL Encoding Combined to Bypass Validation LogicCAPEC-64likelihood: High · High
- Manipulating Web Input to File System CallsCAPEC-76likelihood: High · Very High
- Using Escaped Slashes in Alternate EncodingCAPEC-78likelihood: High · High
- Using Slashes in Alternate EncodingCAPEC-79likelihood: High · High
ATT&CK techniques
—
Change log
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
- hackerone.com/reports/2092852
- security.netapp.com/advisory/ntap-20231116-0009/
- security.netapp.com/advisory/ntap-20241108-0002/
Vendor advisories and official records. Exploit/PoC links are deliberately left out.