The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packaging | Sep 28, 2023 | Aug 21, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Aug 21, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade v8-develUpgrade nodejs-libs-debuginfo | Feb 17, 2025 | Aug 9, 2023 |
| Centos_linux | — | Upgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-debugsource | Sep 27, 2023 | Aug 21, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Aug 21, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Aug 21, 2023 |
| Microsoft Visual_studio | — | Update Microsoft Visual Studio 2019 to the latest version in the LTSC 16.11 version stream, or upgrade to a newer supported version of Visual Studio 2019. | Jun 25, 2025 | Feb 11, 2025 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade npmUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-nodemon | Sep 28, 2023 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade npmUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-full-i18n | Sep 27, 2023 | Aug 21, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 21, 2023 |
| Suse | — | Upgrade nodejs12Upgrade corepack18Upgrade corepack16Upgrade nodejs14-develUpgrade npm12Upgrade nodejs12-docsUpgrade nodejs12-develUpgrade npm16Upgrade nodejs18Upgrade corepack14Upgrade nodejs18-develUpgrade nodejs16-develUpgrade nodejs18-docsUpgrade nodejs14-docsUpgrade npm18Upgrade nodejs14Upgrade npm14Upgrade nodejs16Upgrade nodejs16-docs | Aug 15, 2023 | Aug 14, 2023 |
| Ubuntu | — | Upgrade libnode72Upgrade libnode108Upgrade nodejs | Jul 1, 2024 | Aug 21, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 21, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub