On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade npm | Apr 4, 2024 | Feb 20, 2024 |
| Alpine Linux | — | Upgrade nodejsUpgrade openjdk17Upgrade openjdk21 | Aug 22, 2024 | Feb 20, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs-docsUpgrade nodejs20-develUpgrade v8-11.3-develUpgrade nodejs20-debugsourceUpgrade nodejs20-libsUpgrade nodejs-debugsourceUpgrade nodejs20-npmUpgrade nodejs-debuginfoUpgrade nodejs20-full-i18nUpgrade nodejs20-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-npmUpgrade v8-10.2-develUpgrade nodejs20-debuginfoUpgrade nodejs20Upgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs20-libs-debuginfoUpgrade nodejsUpgrade nodejs-devel | Feb 17, 2025 | Feb 16, 2024 |
| Debian | — | Upgrade nodejs | May 15, 2025 | Feb 20, 2024 |
| Freebsd | — | Upgrade node20Upgrade node16Upgrade node21Upgrade node18Upgrade node | Mar 2, 2024 | Mar 1, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Feb 20, 2024 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemon | Mar 27, 2024 | Feb 16, 2024 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade nodejs-packaging | Mar 27, 2024 | Feb 20, 2024 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debugsource | Mar 28, 2024 | Feb 20, 2024 |
| Suse | — | Upgrade nodejs18-docsUpgrade corepack18Upgrade nodejs18Upgrade npm20Upgrade npm18Upgrade nodejs20Upgrade nodejs20-docsUpgrade nodejs18-develUpgrade corepack20Upgrade nodejs20-devel | Feb 29, 2024 | Feb 20, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub