UpHeron
All vulnerabilities

Servers and applications

CVE-2023-23919

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Severity
High 7.5
Published
23 Feb 2023
Last changed
24 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
14.21.3, 16.19.1, 18.14.1, 19.2.0
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 19.0.0 before 19.2.0
  • From 18.0.0 before 18.14.1
  • From 18.0.0 up to 18.11.0
  • From 16.0.0 before 16.19.1
All 7 release lines
  • From 14.0.0 up to 14.14.0
  • From 14.0.0 before 14.21.3
  • From 16.0.0 up to 16.12.0
  • From 16.0.0 before 16.19.1
  • From 18.0.0 up to 18.11.0
  • From 18.0.0 before 18.14.1
  • From 19.0.0 before 19.2.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-23919
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-23919