Integrity Check Vulnerability in Node.js by Node.js Foundation

CVE-2023-38552

What is CVE-2023-38552?

A vulnerability exists in the Node.js experimental policy mechanism that allows an application to intercept integrity checks. By returning a forged checksum, the application can bypass the safeguard provided by the trusted manifest, undermining the reliability of the integrity verification. This affects all users of the policy mechanism within the versions 18.x and 20.x, which may expose software to potential security risks due to compromised integrity checks.

References