Diffie-Hellman Key Generation Issue in Node.js

CVE-2023-30590

What is CVE-2023-30590?

A misconfiguration in the generateKeys() API function of Node.js leads to improper key generation behavior. The function only generates a private key if none has been set and fails to compute the corresponding public key appropriately after a private key is set. While the documentation suggests it generates both private and public keys, the actual behavior deviates significantly, exposing applications reliant on these APIs to potential security risks. This discrepancy poses broad implications for application-level security, particularly where Diffie-Hellman is employed as a foundational element.

References