CVE-2023-30588
Medium
Description
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.
SeverityMedium
CVSS5.3
Exploit probability67. percentile1.2%
Product
Nodejs Node.js
PublishedNov 28, 2023
First seenNov 28, 2023
How to fix
Update
- nodejs node.js16.20.1, 18.16.1, 20.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nodejs node.js | 16.0.0 ≤ v < 16.20.1, 18.0.0 ≤ v < 18.16.1, 20.0.0 ≤ v < 20.3.1 | 16.20.1, 18.16.1, 20.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.