Cryptographic Flaw in Node.js Releases by OpenJS Foundation
CVE-2023-23919

7.5HIGH

Key Information:

Vendor

Nodejs

Status
Node
Vendor
CVE Published:
23 February 2023

What is CVE-2023-23919?

A cryptographic flaw exists in specific Node.js versions that fails to clear the OpenSSL error stack after certain operations. This oversight can lead to misleading error signals in subsequent cryptographic actions conducted on the same thread, creating opportunities that may result in denial of service.

Affected Version(s)

Node 4.0 < 4.*

Node 5.0 < 5.*

Node 6.0 < 6.*

References

https://nodejs.org/en/blog/vulnerability/february-2023-se...
https://hackerone.com/reports/1808596
https://security.netapp.com/advisory/ntap-20230316-0008/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.