The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packaging-bundler | Sep 28, 2023 | Aug 15, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Aug 15, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-libsUpgrade v8-develUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debuginfo | Feb 17, 2025 | Aug 9, 2023 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-devel | Sep 27, 2023 | Aug 15, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Aug 15, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Aug 15, 2023 |
| Oracle_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-packaging | Sep 28, 2023 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-nodemon | Sep 27, 2023 | Aug 15, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 15, 2023 |
| Suse | — | Upgrade nodejs12-docsUpgrade nodejs14Upgrade corepack18Upgrade nodejs12Upgrade nodejs18-develUpgrade nodejs16-develUpgrade npm12Upgrade npm18Upgrade nodejs18Upgrade nodejs16-docsUpgrade nodejs18-docsUpgrade corepack16Upgrade nodejs12-develUpgrade nodejs14-develUpgrade npm16Upgrade corepack14Upgrade nodejs16Upgrade nodejs14-docsUpgrade npm14 | Aug 15, 2023 | Aug 14, 2023 |
| Ubuntu | — | Upgrade libnode72Upgrade libnode108Upgrade nodejs | Jul 1, 2024 | Aug 15, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub