Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

releasealert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

Privacy Policy
Terms of Service
Contact

CVE-2023-32004 — HIGH severity vulnerability | Release Alert

CVE-2023-32004

8.8

HIGHCVSS v3

Published

August 15, 2023

Affected

15 projects

Assigned by

[email protected]

Severity scale

010

Description

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

@externs/nodejs

NPMThe Closure Compiler Externs For Node.JS.

= *, >= 20.0.0, <= 20.5.0NVD

externs/nodejs

GitHubThe Externs For Node.JS.

= *, >= 20.0.0, <= 20.5.0NVD

@depack/nodejs

NPM

More on this CVE

NVD↗GitHub Advisory↗

Mocks Of Built-In Node.JS Modules To Use For Compilation.

= *, >= 20.0.0, <= 20.5.0NVD

@opencensus/nodejs

NPMOpenCensus is a toolkit for collecting application performance and behavior data.

= *, >= 20.0.0, <= 20.5.0NVD

dpck/nodejs

GitHubMocks Of Built-In Node.JS Modules To Use For Compilation.

= *, >= 20.0.0, <= 20.5.0NVD

nodejs

Python Package IndexPython bindings and utils for Node.js and io.js

= *, >= 20.0.0, <= 20.5.0NVD

nodejs

NPM

= *, >= 20.0.0, <= 20.5.0NVD

nodejs

Crates.ioEmbedding Node.js in Rust

= *, >= 20.0.0, <= 20.5.0NVD

node.js

NPMsecurity holding package

= *, >= 20.0.0, <= 20.5.0NVD

Node.js

NuGet GalleryNode.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world.

= *, >= 20.0.0, <= 20.5.0NVD

fedora

Crates.ioBase library for interacting with Fedora web services

= 37, = 38NVD

fedora

Python Package IndexPlaceholder for the fedora name

= 37, = 38NVD