The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18n | Sep 28, 2023 | Aug 15, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Aug 15, 2023 |
| Amazon_linux_2023 | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade v8-develUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-devel | Feb 17, 2025 | Aug 9, 2023 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfo | Sep 27, 2023 | Aug 15, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Aug 15, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Aug 15, 2023 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs | Sep 28, 2023 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade npmUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-debugsource | Sep 27, 2023 | Aug 15, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 15, 2023 |
| Suse | — | Upgrade nodejs12Upgrade nodejs14Upgrade corepack18Upgrade nodejs16-develUpgrade nodejs18-develUpgrade npm12Upgrade nodejs12-docsUpgrade npm14Upgrade nodejs14-docsUpgrade npm16Upgrade nodejs16-docsUpgrade corepack16Upgrade nodejs18-docsUpgrade corepack14Upgrade npm18Upgrade nodejs18Upgrade nodejs16Upgrade nodejs14-develUpgrade nodejs12-devel | Aug 15, 2023 | Aug 14, 2023 |
| Ubuntu | — | Upgrade nodejsUpgrade libnode108Upgrade libnode72 | Jul 1, 2024 | Aug 15, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 15, 2023 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub