The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemon | Sep 28, 2023 | Aug 21, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Aug 21, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade v8-develUpgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade npm | Feb 17, 2025 | Aug 9, 2023 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-packaging-bundler | Sep 27, 2023 | Aug 21, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Aug 21, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Aug 21, 2023 |
| Microsoft Visual_studio | — | Update Microsoft Visual Studio 2019 to the latest version in the LTSC 16.11 version stream, or upgrade to a newer supported version of Visual Studio 2019. | Jun 25, 2025 | Feb 11, 2025 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-full-i18n | Sep 28, 2023 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade npmUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-libs-debuginfo | Sep 27, 2023 | Aug 21, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 21, 2023 |
| Suse | — | Upgrade nodejs16Upgrade npm14Upgrade npm16Upgrade nodejs18-develUpgrade corepack14Upgrade nodejs16-develUpgrade nodejs14Upgrade npm18Upgrade nodejs16-docsUpgrade nodejs14-docsUpgrade nodejs18Upgrade nodejs18-docsUpgrade nodejs14-develUpgrade nodejs12Upgrade corepack16Upgrade nodejs12-develUpgrade corepack18Upgrade npm12Upgrade nodejs12-docs | Aug 15, 2023 | Aug 14, 2023 |
| Ubuntu | — | Upgrade nodejsUpgrade libnode108Upgrade libnode72 | Jul 1, 2024 | Aug 21, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 21, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub