CVE-2023-32559: nodejs node Improper Privilege Management
Vulnerability summary
CVE-2023-32559 is a high (CVSS 7.5) Improper Privilege Management vulnerability in nodejs node. EPSS estimates a 1.80% chance of exploitation in the next 30 days, higher than 78.5% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 19 · Related 14Timeline
- 24-08-2023PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.80%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.80% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard3 products
- nodejs-16< 16.20.2-r0
- nodejs-18< 18.17.1-r0
- nodejs-20< 20.5.1-r0
Wolfi3 products
- nodejs-16< 16.20.2-r0
- nodejs-18< 18.17.1-r0
- nodejs-20< 20.5.1-r0
Nodejs2 products
- node≥ 4.0, < 4.* | ≥ 5.0, < 5.* | ≥ 6.0, < 6.* | ≥ 7.0, < 7.* | ≥ 8.0, < 8.* | ≥ 9.0, < 9.* | ≥ 10.0, < 10.* | ≥ 11.0, < 11.* | ≥ 12.0, < 12.* | ≥ 13.0, < 13.* | ≥ 14.0, < 14.* | ≥ 15.0, < 15.* | ≥ 16.0, < 16.20.2 | ≥ 17.0, < 17.* | ≥ 18.0, < 18.17.1 | ≥ 19.0, < 19.* | ≥ 20.0, < 20.5.1
- node.js≥ 16.0.0, ≤ 16.20.1 | ≥ 18.0.0, ≤ 18.17.0 | ≥ 20.0.0, ≤ 20.5.0
Alpine1 product
- nodejs< 16.20.2-r0 | < 18.17.1-r0
Debian1 product
- nodejs< 18.19.0+dfsg-6~deb12u1 | < 18.13.0+dfsg1-1.1
Ubuntu1 product
- nodejs< 12.22.9~dfsg-1ubuntu3.6
6 vendors · 11 products
