When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-nodejsalma-upgrade-nodejs-develalma-upgrade-nodejs-docsalma-upgrade-nodejs-full-i18nalma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packagingalma-upgrade-nodejs-packaging-bundleralma-upgrade-npm | Oct 23, 2023 | Oct 18, 2023 | |
| Alpine Linux | alpine-linux-upgrade-nodejsalpine-linux-upgrade-nodejs-current | Mar 26, 2024 | Oct 18, 2023 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-nodejsamazon-linux-2023-upgrade-nodejs-debuginfoamazon-linux-2023-upgrade-nodejs-debugsourceamazon-linux-2023-upgrade-nodejs-develamazon-linux-2023-upgrade-nodejs-docsamazon-linux-2023-upgrade-nodejs-full-i18namazon-linux-2023-upgrade-nodejs-libsamazon-linux-2023-upgrade-nodejs-libs-debuginfoamazon-linux-2023-upgrade-nodejs-npmamazon-linux-2023-upgrade-v8-10-2-devel | Feb 17, 2025 | Oct 13, 2023 | |
| Centos_linux | — | centos-upgrade-nodejscentos-upgrade-nodejs-debuginfocentos-upgrade-nodejs-debugsourcecentos-upgrade-nodejs-develcentos-upgrade-nodejs-docscentos-upgrade-nodejs-full-i18ncentos-upgrade-nodejs-nodemoncentos-upgrade-nodejs-packagingcentos-upgrade-nodejs-packaging-bundlercentos-upgrade-npm | Nov 1, 2023 | Oct 18, 2023 |
| Debian | debian-upgrade-nodejs | Jan 3, 2024 | Oct 18, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-net-libs-nodejs | May 15, 2025 | Oct 18, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-nodejs-packaging-bundleroracle-linux-upgrade-npm | Oct 23, 2023 | Oct 13, 2023 |
| Redhat_linux | redhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-nodejs-packaging-bundlerredhat-upgrade-npm | Nov 1, 2023 | Oct 18, 2023 | |
| Suse | — | suse-upgrade-corepack14suse-upgrade-corepack16suse-upgrade-corepack18suse-upgrade-nodejs12suse-upgrade-nodejs12-develsuse-upgrade-nodejs12-docssuse-upgrade-nodejs14suse-upgrade-nodejs14-develsuse-upgrade-nodejs14-docssuse-upgrade-nodejs16suse-upgrade-nodejs16-develsuse-upgrade-nodejs16-docssuse-upgrade-nodejs18suse-upgrade-nodejs18-develsuse-upgrade-nodejs18-docssuse-upgrade-npm12suse-upgrade-npm14suse-upgrade-npm16suse-upgrade-npm18 | Oct 23, 2023 | Oct 18, 2023 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Oct 18, 2023 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Oct 18, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub