vulnerability

Amazon Linux 2023: CVE-2023-30581: Important priority package update for nodejs

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:C/A:N)
Published
Jun 20, 2023
Added
Feb 17, 2025
Modified
Jul 4, 2025

Description

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js
A vulnerability has been discovered in Node.js, where the use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.

Solutions

amazon-linux-2023-upgrade-nodejsamazon-linux-2023-upgrade-nodejs-debuginfoamazon-linux-2023-upgrade-nodejs-debugsourceamazon-linux-2023-upgrade-nodejs-develamazon-linux-2023-upgrade-nodejs-docsamazon-linux-2023-upgrade-nodejs-full-i18namazon-linux-2023-upgrade-nodejs-libsamazon-linux-2023-upgrade-nodejs-libs-debuginfoamazon-linux-2023-upgrade-npmamazon-linux-2023-upgrade-v8-devel
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.