---
id: CVE-2023-30588
title: >-
  When an invalid public key is used to create an x509 certificate using the
  crypto.X509Certificate() API a non-expect termination occurs making it
  susceptible to DoS attacks when the attacker could force interruptions of
  application proce…
summary: >-
  When an invalid public key is used to create an x509 certificate using the
  crypto.X509Certificate() API a non-expect termination occurs making it
  susceptible to DoS attacks when the attacker could force interruptions of
  application proce…
severity: none
vendor: NodeJS
product: Node
affected:
  - Node >= 4.0 < 4.*
  - Node >= 5.0 < 5.*
  - Node >= 6.0 < 6.*
  - Node >= 7.0 < 7.*
  - Node >= 8.0 < 8.*
  - Node >= 9.0 < 9.*
  - Node >= 10.0 < 10.*
  - Node >= 11.0 < 11.*
  - Node >= 12.0 < 12.*
  - Node >= 13.0 < 13.*
  - Node >= 14.0 < 14.*
  - Node >= 15.0 < 15.*
  - Node >= 16.0 < 16.20.1
  - Node >= 17.0 < 17.*
  - Node >= 18.0 < 18.16.1
  - Node >= 19.0 < 19.*
  - Node >= 20.0 < 20.3.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T22:34:23.710890Z'
published: '2023-11-28'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T22:34:38.970Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-30588'
references:
  - url: 'https://nodejs.org/en/blog/vulnerability/june-2023-security-releases'
  - url: 'https://security.netapp.com/advisory/ntap-20240621-0006/'
tags:
  - cve.org
epss: 0.01157
epssPercentile: 0.67165
ingestedAt: '2026-11-05T19:30:42.879Z'
---

## Overview

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

## Affected

- `Node >= 4.0 < 4.*`
- `Node >= 5.0 < 5.*`
- `Node >= 6.0 < 6.*`
- `Node >= 7.0 < 7.*`
- `Node >= 8.0 < 8.*`
- `Node >= 9.0 < 9.*`
- `Node >= 10.0 < 10.*`
- `Node >= 11.0 < 11.*`
- `Node >= 12.0 < 12.*`
- `Node >= 13.0 < 13.*`
- `Node >= 14.0 < 14.*`
- `Node >= 15.0 < 15.*`
- `Node >= 16.0 < 16.20.1`
- `Node >= 17.0 < 17.*`
- `Node >= 18.0 < 18.16.1`
- `Node >= 19.0 < 19.*`
- `Node >= 20.0 < 20.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.