CVE-2023-32558: nodejs node
Vulnerability summary
CVE-2023-32558 is a high (CVSS 7.5) vulnerability in nodejs node. EPSS estimates a 1.74% chance of exploitation in the next 30 days, higher than 77.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 3Timeline
- 12-09-2023PublishedVulnerability first disclosed.
- 02-11-2026Last modifiedVulnerability information updated.
Description
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.74%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.74% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Nodejs2 products
Chainguard1 product
- nodejs-20< 20.5.1-r0
Wolfi1 product
- nodejs-20< 20.5.1-r0
3 vendors · 4 products