When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade npmUpgrade nodejs-nodemon | Oct 23, 2023 | Oct 18, 2023 |
| Alpine Linux | — | Upgrade nodejs-currentUpgrade nodejs | Mar 26, 2024 | Oct 18, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-libsUpgrade nodejs-npmUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade v8-10.2-develUpgrade nodejs | Feb 17, 2025 | Oct 13, 2023 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packaging-bundler | Nov 1, 2023 | Oct 18, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Oct 18, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Oct 18, 2023 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-full-i18n | Oct 23, 2023 | Oct 13, 2023 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejsNo solution existsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade npm | Nov 1, 2023 | Oct 18, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Oct 18, 2023 |
| Suse | — | Upgrade npm16Upgrade nodejs12Upgrade nodejs16-docsUpgrade nodejs18Upgrade npm14Upgrade nodejs12-docsUpgrade nodejs14-develUpgrade corepack18Upgrade nodejs18-develUpgrade nodejs18-docsUpgrade nodejs14Upgrade npm18Upgrade nodejs12-develUpgrade corepack16Upgrade nodejs14-docsUpgrade corepack14Upgrade npm12Upgrade nodejs16Upgrade nodejs16-devel | Oct 23, 2023 | Oct 18, 2023 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 18, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 18, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub