---
id: CVE-2023-32558
title: >-
  The use of the deprecated API `process.binding()` can bypass the permission
  model through path traversal
summary: >-
  The use of the deprecated API `process.binding()` can bypass the permission
  model through path traversal. 


  This vulnerability affects all users using the experimental permission model
  in Node.js 20.x.


  Please note that at the time this …
severity: none
vendor: NodeJS
product: Node
affected:
  - Node >= 4.0 < 4.*
  - Node >= 5.0 < 5.*
  - Node >= 6.0 < 6.*
  - Node >= 7.0 < 7.*
  - Node >= 8.0 < 8.*
  - Node >= 9.0 < 9.*
  - Node >= 10.0 < 10.*
  - Node >= 11.0 < 11.*
  - Node >= 12.0 < 12.*
  - Node >= 13.0 < 13.*
  - Node >= 14.0 < 14.*
  - Node >= 15.0 < 15.*
  - Node >= 17.0 < 17.*
  - Node >= 19.0 < 19.*
  - Node >= 20.0 < 20.5.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-08T21:07:36.422694Z'
published: '2023-09-12'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T22:35:26.152Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-32558'
references:
  - url: 'https://hackerone.com/reports/2051257'
tags:
  - cve.org
epss: 0.01743
epssPercentile: 0.77839
ingestedAt: '2026-11-05T19:30:42.878Z'
---

## Overview

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. 

This vulnerability affects all users using the experimental permission model in Node.js 20.x.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

## Affected

- `Node >= 4.0 < 4.*`
- `Node >= 5.0 < 5.*`
- `Node >= 6.0 < 6.*`
- `Node >= 7.0 < 7.*`
- `Node >= 8.0 < 8.*`
- `Node >= 9.0 < 9.*`
- `Node >= 10.0 < 10.*`
- `Node >= 11.0 < 11.*`
- `Node >= 12.0 < 12.*`
- `Node >= 13.0 < 13.*`
- `Node >= 14.0 < 14.*`
- `Node >= 15.0 < 15.*`
- `Node >= 17.0 < 17.*`
- `Node >= 19.0 < 19.*`
- `Node >= 20.0 < 20.5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.