Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.
This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade npmUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packaging-bundler | Oct 23, 2023 | Oct 18, 2023 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Oct 1, 2024 | Sep 7, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade v8-10.2-develUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-npm | Feb 17, 2025 | Oct 13, 2023 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-nodemon | Nov 1, 2023 | Oct 18, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Jan 3, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Sep 7, 2024 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-docs | Jul 22, 2024 | Oct 13, 2023 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerNo solution existsUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-nodemon | Nov 1, 2023 | Oct 18, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Nov 28, 2023 |
| Suse | — | Upgrade corepack18Upgrade npm16Upgrade nodejs16-docsUpgrade nodejs18-docsUpgrade nodejs18-develUpgrade nodejs16Upgrade nodejs18Upgrade npm18Upgrade nodejs16-develUpgrade corepack16 | Oct 23, 2023 | Oct 19, 2023 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 7, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub