CVE-2023-32559 Privilege escalation in Node

What is CVE-2023-32559?

CVE-2023-32559 is a high-severity vulnerability in Nodejs Node.js, published on 24 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

Weakness: CWE-269

Which versions are affected by CVE-2023-32559?

2 open source packages ship an affected version, including node and node-min. It affects 1 product.

Products include Nodejs Node.js.

How do I fix CVE-2023-32559?

Upgrade node to a fixed version for your release line: 16.20.2, 18.17.1 or 20.5.1.

Is CVE-2023-32559 being exploited?

There is no known exploitation of CVE-2023-32559 in the wild and no public exploit code.

Other vulnerabilities in Nodejs Node.js

• CVE-2023-32002 Security feature bypass in Node Critical 9.8
• CVE-2016-6303 Integer overflow in n/a Critical 9.8
• CVE-2017-15896 Security feature bypass in Node.js Critical 9.1
• CVE-2018-7160 Server-side request forgery in Node.js High 8.8
• CVE-2018-12120 Misconfiguration in Node.js High 8.1

All Nodejs Node.js vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2023-32559, AZL-27973, AZL-27974, BIT-node-2023-32559, BIT-node-min-2023-32559, CLEANSTART-2026-BO73715 and 4 more.