UpHeron
All vulnerabilities

Servers and applications

CVE-2023-39332

Path traversal through path stored in Uint8Array

Severity
Critical 9.8
Published
13 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
20.8.0, 20.8.1
Sources
NVD, nodejs

Description

Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects. This is distinct from CVE-2023-32004 which only referred to…

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 20.0.0 before 20.8.1
  • From 20.0.0 before 20.8.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-39332
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-39332
  • Node.js security release https://nodejs.org/en/blog/vulnerability/october-2023-security-releases