CVE-2023-38552

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-345

Affected software

VendorProductVersions
NodeJSNode>= 4.0, < 4.*; >= 5.0, < 5.*; >= 6.0, < 6.*; >= 7.0, < 7.*; >= 8.0, < 8.*; >= 9.0, < 9.*; >= 10.0, < 10.*; >= 11.0, < 11.*; >= 12.0, < 12.*; >= 13.0, < 13.*; >= 14.0, < 14.*; >= 15.0, < 15.*; >= 16.0, < 16.*; >= 17.0, < 17.*; >= 18.0, < 18.18.2; >= 19.0, < 19.*; >= 20.0, < 20.8.1

References

Timeline

Published
Oct 18, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-385536.7In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege witCVE-2023-385545.5In wcn bsp driver, there is a possible out of bounds write due to a missing bounds check.This could lead to local denial of service with no CVE-2023-385558.8Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attackeCVE-2023-385567.5Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the printer. [Note] Web CoCVE-2023-385577.8A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected product assigns improper access rights to the uCVE-2023-385585.5A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration ConsoleCVE-2023-385595.5A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to caCVE-2023-38566.1A vulnerability, which was classified as problematic, has been found in phpscriptpoint Ecommerce 1.15. Affected by this issue is some unknowCVE-2023-385605.5An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a CVE-2023-385617.8Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalatCVE-2023-385629.1A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafteCVE-2023-385638.8Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allo
CVE-2023-38552: High severity, CVSS 7.5 | Vulnix