UpHeron
All vulnerabilities

Servers and applications

CVE-2023-30585

A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user's registry.…

Severity
High 7.5
Published
28 Nov 2023
Last changed
8 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
16.20.1, 18.16.1, 20.3.1
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 16.0.0 before 16.20.1
  • From 18.0.0 before 18.16.1
  • From 20.0.0 before 20.3.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-30585
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-30585