CVE-2023-32006

Aliases:ALPINE-CVE-2023-32006DEBIAN-CVE-2023-32006CGA-345j-c9r7-cf8rCGA-37w3-79w7-2pgqCGA-fq9g-v946-m77jCGA-p64r-5g9p-455gCGA-pmh2-9c4c-f8jmCGA-wc92-pv63-jcwm
Advisory lineage Upstream: 0 Downstream: 21
Modified
Published: 15 Aug 2023, 15:10
Last modified:08 May 2025, 16:07

Vulnerability Summary

Overall Risk (default)
medium
36/100
CVSS Score
8.8 HIGH
v3.1 (cve.org)
EPSS Score
1.54% LOW
2% probability +1.47%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

15 Aug 2023, 15:10
Published
Vulnerability first disclosed
08 May 2025, 16:07
Last Modified
Vulnerability information updated

Description

The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

CVSS Metrics

  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 1.54%• Percentile: 74%

Techniques & Countermeasures

  • CWE-693•Protection Mechanism Failure

    The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Affected Systems

  • alpine•nodejs

    < 16.20.2-r0 | < 16.20.2-r0 | < 18.17.1-r0 | < 18.17.1-r0 | < 18.17.1-r0 | < 18.17.1-r0 | < 18.17.1-r0 | < 18.17.1-r0 | < 18.17.1-r0 | < 18.17.1-r0

  • chainguard•nodejs-16

    < 16.20.2-r0

  • chainguard•nodejs-18

    < 18.17.1-r0

  • chainguard•nodejs-20

    < 20.5.1-r0

  • wolfi•nodejs-16

    < 16.20.2-r0

  • wolfi•nodejs-18

    < 18.17.1-r0

  • wolfi•nodejs-20

    < 20.5.1-r0

  • debian•nodejs

    all | < 18.19.0+dfsg-6~deb12u1 | < 18.13.0+dfsg1-1.1 | < 18.13.0+dfsg1-1.1

  • fedoraproject•fedora

    37 | 38

  • nodejs•node

    ≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.* | ≥ 15.0, < 15.* | ≥ 16.0, < 16.20.2 | ≥ 17.0, < 17.* | ≥ 18.0, < 18.17.1 | ≥ 19.0, < 19.* | ≥ 20.0, < 20.5.1

  • nodejs•node.js

    ≥ 16.0.0, ≤ 16.20.1 | ≥ 18.0.0, ≤ 18.17.0 | ≥ 20.0.0, ≤ 20.5.0

References (8)