UpHeron
All vulnerabilities

Servers and applications

CVE-2023-38552

Integrity checks according to policies can be circumvented

Severity
High 7.5
Published
13 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
18.18.2, 20.8.1
Sources
NVD, nodejs

Description

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note…

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 18.0.0 up to 18.18.1
  • From 18.0.0 before 18.18.2
  • From 20.0.0 before 20.8.1
  • From 20.1.0 up to 20.8.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-38552
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-38552
  • Node.js security release https://nodejs.org/en/blog/vulnerability/october-2023-security-releases