CVE-2023-32004

HIGH

Node.js <20 - Buffer Overflow

Title source: llm

Description

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

References (4)

[Issue Tracking] https://hackerone.com/reports/2038134

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/[email protected]/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/[email protected]/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/

[Vendor Advisory] https://security.netapp.com/advisory/ntap-20230915-0009/

Scores

CVSS v3 8.8

EPSS 0.0014

EPSS Percentile 34.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-22

Status published

Affected Products (3)

nodejs/node.js < 20.5.0

fedoraproject/fedora

fedoraproject/fedora

Timeline

Published Aug 15, 2023

Tracked Since Feb 18, 2026