CVE-2023-30588

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected software

No affected versions have been published.

Timeline

Published
Nov 28, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-305897.5The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTPCVE-2023-30599.8A vulnerability, which was classified as critical, was found in SourceCodester Online Exam Form Submission 1.0. This affects an unknown partCVE-2023-305907.5The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generCVE-2023-305917.5Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `eventCVE-2023-30605.4A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as problematic. This vulnerability affects CVE-2023-306017.8Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache CassandraCVE-2023-306027.5Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacker can exploit this vCVE-2023-306039.8Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to changCVE-2023-306049.8It is identified a vulnerability of insufficient authentication in the system configuration interface of Hitron Technologies CODA-5310. An uCVE-2023-306056.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attackeCVE-2023-306064.9Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary metCVE-2023-306078.8icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field co