Back
CVE-2023-38552
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation…
High7.5EPSS 1.2%
- Published
- Updated
- Reserved
- Assigned by
- hackerone
Description
When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
- EPSS (exploitation in 30 days)
- 1.2% · top 31% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
- affected 4.0 – < 4.*
- affected 5.0 – < 5.*
- affected 6.0 – < 6.*
- affected 7.0 – < 7.*
- affected 8.0 – < 8.*
- affected 9.0 – < 9.*
- affected 10.0 – < 10.*
- affected 11.0 – < 11.*
- affected 12.0 – < 12.*
- affected 13.0 – < 13.*
- affected 14.0 – < 14.*
- affected 15.0 – < 15.*
- affected 16.0 – < 16.*
- affected 17.0 – < 17.*
- affected 18.0 – < 18.18.2
- affected 19.0 – < 19.*
- affected 20.0 – < 20.8.1
References (9)
- https://hackerone.com/reports/2094235 (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20231116-0013/ (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20241108-0002/ (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-38552)Record last updated .