CVE-2023-30588None▾ SunlitWhen an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application proce…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.2%
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.
Node >= 4.0 < 4.*Node >= 5.0 < 5.*Node >= 6.0 < 6.*Node >= 7.0 < 7.*Node >= 8.0 < 8.*Node >= 9.0 < 9.*Node >= 10.0 < 10.*Node >= 11.0 < 11.*Node >= 12.0 < 12.*Node >= 13.0 < 13.*Node >= 14.0 < 14.*Node >= 15.0 < 15.*Node >= 16.0 < 16.20.1Node >= 17.0 < 17.*Node >= 18.0 < 18.16.1Node >= 19.0 < 19.*Node >= 20.0 < 20.3.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-30590High· 7.5The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corre…
CVE-2023-30585High· 7.5A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer
CVE-2023-30589High· 7.5The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests
CVE-2023-32558NoneThe use of the deprecated API `process.binding()` can bypass the permission model through path traversal
CVE-2026-106071Low· 3.6A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the r…
CVE-2026-106072Medium· 6.7A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`…