The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packaging | Sep 28, 2023 | Aug 21, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Aug 21, 2023 |
| Amazon_linux_2023 | — | Upgrade v8-develUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsource | Feb 17, 2025 | Aug 9, 2023 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-packaging-bundler | Sep 27, 2023 | Aug 21, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Aug 21, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Aug 21, 2023 |
| Microsoft Visual_studio | — | Update Microsoft Visual Studio 2019 to the latest version in the LTSC 16.11 version stream, or upgrade to a newer supported version of Visual Studio 2019. | Jun 25, 2025 | Feb 11, 2025 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejsUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs | Sep 28, 2023 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade npmUpgrade nodejs-full-i18n | Sep 27, 2023 | Aug 21, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 21, 2023 |
| Suse | — | Upgrade nodejs16-docsUpgrade nodejs18Upgrade nodejs16Upgrade nodejs18-develUpgrade nodejs16-develUpgrade npm16Upgrade npm14Upgrade corepack14Upgrade nodejs14-docsUpgrade npm18Upgrade nodejs14Upgrade nodejs18-docsUpgrade corepack18Upgrade corepack16Upgrade nodejs14-develUpgrade nodejs12-develUpgrade nodejs12Upgrade nodejs12-docsUpgrade npm12 | Aug 15, 2023 | Aug 14, 2023 |
| Ubuntu | — | Upgrade libnode108Upgrade nodejsUpgrade libnode72 | Jul 1, 2024 | Aug 21, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 21, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub