UpHeron
All vulnerabilities

Servers and applications

CVE-2023-30581

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

Severity
High 7.5
Published
23 Nov 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
16.20.1, 18.16.1, 20.3.1
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 16.0.0 before 16.20.1
  • From 18.0.0 before 18.16.1
  • From 20.0.0 before 20.3.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-30581
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-30581