CVE-2023-30581 - Vulnerability Details

Vendors	Products
Nodejs	Node.js
Redhat	Enterprise Linux Rhel Eus

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
nodejs:18-8080020230718130356.63b34585	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:4536	2023-08-08T00:00:00Z
nodejs:16-8080020230718141521.63b34585	cpe:/a:redhat:enterprise_linux:8	RHSA-2023:4537	2023-08-08T00:00:00Z
Red Hat Enterprise Linux 8.6 Extended Update Support
nodejs:16-8060020230906023909.ad008a3a	cpe:/a:redhat:rhel_eus:8.6	RHSA-2023:5361	2023-09-26T00:00:00Z
Red Hat Enterprise Linux 9
nodejs:18-9020020230717125503.rhel9	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:4330	2023-07-31T00:00:00Z
nodejs-1:16.20.1-1.el9_2	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:4331	2023-07-31T00:00:00Z
Red Hat Enterprise Linux 9.0 Extended Update Support
nodejs-1:16.20.2-1.el9_0	cpe:/a:redhat:rhel_eus:9.0	RHSA-2023:5533	2023-10-09T00:00:00Z

Link	Providers
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
https://nvd.nist.gov/vuln/detail/CVE-2023-30581
https://security.netapp.com/advisory/ntap-20241101-0011/
https://www.cve.org/CVERecord?id=CVE-2023-30581

Type	Values Removed	Values Added
References		https://security.netapp.com/advisory/ntap-20241101-0011/

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Weaknesses		CWE-862

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-30581", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2023-04-13T01:00:12.085Z", "datePublished": "2023-11-22T23:28:30.768Z", "dateUpdated": "2025-11-03T21:48:01.028Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js"}], "affected": [{"product": "Node", "vendor": "NodeJS", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "4.0", "status": "affected", "lessThan": "4.*"}, {"versionType": "semver", "version": "5.0", "status": "affected", "lessThan": "5.*"}, {"versionType": "semver", "version": "6.0", "status": "affected", "lessThan": "6.*"}, {"versionType": "semver", "version": "7.0", "status": "affected", "lessThan": "7.*"}, {"versionType": "semver", "version": "8.0", "status": "affected", "lessThan": "8.*"}, {"versionType": "semver", "version": "9.0", "status": "affected", "lessThan": "9.*"}, {"versionType": "semver", "version": "10.0", "status": "affected", "lessThan": "10.*"}, {"versionType": "semver", "version": "11.0", "status": "affected", "lessThan": "11.*"}, {"versionType": "semver", "version": "12.0", "status": "affected", "lessThan": "12.*"}, {"versionType": "semver", "version": "13.0", "status": "affected", "lessThan": "13.*"}, {"versionType": "semver", "version": "14.0", "status": "affected", "lessThan": "14.*"}, {"versionType": "semver", "version": "15.0", "status": "affected", "lessThan": "15.*"}, {"versionType": "semver", "version": "16.0", "status": "affected", "lessThan": "16.20.1"}, {"versionType": "semver", "version": "17.0", "status": "affected", "lessThan": "17.*"}, {"versionType": "semver", "version": "18.0", "status": "affected", "lessThan": "18.16.1"}, {"versionType": "semver", "version": "19.0", "status": "affected", "lessThan": "19.*"}, {"versionType": "semver", "version": "20.0", "status": "affected", "lessThan": "20.3.1"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-04-30T22:24:49.919Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20241101-0011/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:48:01.028Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-06-05T14:18:07.496118Z", "id": "CVE-2023-30581", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-05T14:19:27.519Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.2 (string)

cveMetadata : { »

cveId : CVE-2023-30581 (string)

assignerOrgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

state : PUBLISHED (string)

assignerShortName : hackerone (string)

dateReserved : 2023-04-13T01:00:12.085Z (string)

datePublished : 2023-11-22T23:28:30.768Z (string)

dateUpdated : 2025-11-03T21:48:01.028Z (string)

}

containers : { »

cna : { »

descriptions : [ »

0 : { »

lang : en (string)

value : The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js (string)

}

]

affected : [ »

0 : { »

product : Node (string)

vendor : NodeJS (string)

defaultStatus : unaffected (string)

versions : [ »

0 : { »

versionType : semver (string)

version : 4.0 (string)

status : affected (string)

lessThan : 4.* (string)

}

1 : { »

versionType : semver (string)

version : 5.0 (string)

status : affected (string)

lessThan : 5.* (string)

}

2 : { »

versionType : semver (string)

version : 6.0 (string)

status : affected (string)

lessThan : 6.* (string)

}

3 : { »

versionType : semver (string)

version : 7.0 (string)

status : affected (string)

lessThan : 7.* (string)

}

4 : { »

versionType : semver (string)

version : 8.0 (string)

status : affected (string)

lessThan : 8.* (string)

}

5 : { »

versionType : semver (string)

version : 9.0 (string)

status : affected (string)

lessThan : 9.* (string)

}

6 : { »

versionType : semver (string)

version : 10.0 (string)

status : affected (string)

lessThan : 10.* (string)

}

7 : { »

versionType : semver (string)

version : 11.0 (string)

status : affected (string)

lessThan : 11.* (string)

}

8 : { »

versionType : semver (string)

version : 12.0 (string)

status : affected (string)

lessThan : 12.* (string)

}

9 : { »

versionType : semver (string)

version : 13.0 (string)

status : affected (string)

lessThan : 13.* (string)

}

10 : { »

versionType : semver (string)

version : 14.0 (string)

status : affected (string)

lessThan : 14.* (string)

}

11 : { »

versionType : semver (string)

version : 15.0 (string)

status : affected (string)

lessThan : 15.* (string)

}

12 : { »

versionType : semver (string)

version : 16.0 (string)

status : affected (string)

lessThan : 16.20.1 (string)

}

13 : { »

versionType : semver (string)

version : 17.0 (string)

status : affected (string)

lessThan : 17.* (string)

}

14 : { »

versionType : semver (string)

version : 18.0 (string)

status : affected (string)

lessThan : 18.16.1 (string)

}

15 : { »

versionType : semver (string)

version : 19.0 (string)

status : affected (string)

lessThan : 19.* (string)

}

16 : { »

versionType : semver (string)

version : 20.0 (string)

status : affected (string)

lessThan : 20.3.1 (string)

}

]

}

]

references : [ »

0 : { »

url : https://nodejs.org/en/blog/vulnerability/june-2023-security-releases (string)

}

]

providerMetadata : { »

orgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

shortName : hackerone (string)

dateUpdated : 2025-04-30T22:24:49.919Z (string)

}

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://nodejs.org/en/blog/vulnerability/june-2023-security-releases (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://security.netapp.com/advisory/ntap-20241101-0011/ (string)

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2025-11-03T21:48:01.028Z (string)

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-862 (string)

lang : en (string)

description : CWE-862 Missing Authorization (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-06-05T14:18:07.496118Z (string)

id : CVE-2023-30581 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-06-05T14:19:27.519Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20241101-0011/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:48:01.028Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-30581", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-05T14:18:07.496118Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-05T14:19:19.818Z"}}], "cna": {"affected": [{"vendor": "NodeJS", "product": "Node", "versions": [{"status": "affected", "version": "4.0", "lessThan": "4.*", "versionType": "semver"}, {"status": "affected", "version": "5.0", "lessThan": "5.*", "versionType": "semver"}, {"status": "affected", "version": "6.0", "lessThan": "6.*", "versionType": "semver"}, {"status": "affected", "version": "7.0", "lessThan": "7.*", "versionType": "semver"}, {"status": "affected", "version": "8.0", "lessThan": "8.*", "versionType": "semver"}, {"status": "affected", "version": "9.0", "lessThan": "9.*", "versionType": "semver"}, {"status": "affected", "version": "10.0", "lessThan": "10.*", "versionType": "semver"}, {"status": "affected", "version": "11.0", "lessThan": "11.*", "versionType": "semver"}, {"status": "affected", "version": "12.0", "lessThan": "12.*", "versionType": "semver"}, {"status": "affected", "version": "13.0", "lessThan": "13.*", "versionType": "semver"}, {"status": "affected", "version": "14.0", "lessThan": "14.*", "versionType": "semver"}, {"status": "affected", "version": "15.0", "lessThan": "15.*", "versionType": "semver"}, {"status": "affected", "version": "16.0", "lessThan": "16.20.1", "versionType": "semver"}, {"status": "affected", "version": "17.0", "lessThan": "17.*", "versionType": "semver"}, {"status": "affected", "version": "18.0", "lessThan": "18.16.1", "versionType": "semver"}, {"status": "affected", "version": "19.0", "lessThan": "19.*", "versionType": "semver"}, {"status": "affected", "version": "20.0", "lessThan": "20.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"}], "descriptions": [{"lang": "en", "value": "The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-04-30T22:24:49.919Z"}}}, "cveMetadata": {"cveId": "CVE-2023-30581", "state": "PUBLISHED", "dateUpdated": "2025-11-03T21:48:01.028Z", "dateReserved": "2023-04-13T01:00:12.085Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2023-11-22T23:28:30.768Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://nodejs.org/en/blog/vulnerability/june-2023-security-releases (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://security.netapp.com/advisory/ntap-20241101-0011/ (string)

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2025-11-03T21:48:01.028Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-30581 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-06-05T14:18:07.496118Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-862 (string)

description : CWE-862 Missing Authorization (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-06-05T14:19:19.818Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : NodeJS (string)

product : Node (string)

versions : [ »

0 : { »

status : affected (string)

version : 4.0 (string)

lessThan : 4.* (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 5.0 (string)

lessThan : 5.* (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 6.0 (string)

lessThan : 6.* (string)

versionType : semver (string)

}

3 : { »

status : affected (string)

version : 7.0 (string)

lessThan : 7.* (string)

versionType : semver (string)

}

4 : { »

status : affected (string)

version : 8.0 (string)

lessThan : 8.* (string)

versionType : semver (string)

}

5 : { »

status : affected (string)

version : 9.0 (string)

lessThan : 9.* (string)

versionType : semver (string)

}

6 : { »

status : affected (string)

version : 10.0 (string)

lessThan : 10.* (string)

versionType : semver (string)

}

7 : { »

status : affected (string)

version : 11.0 (string)

lessThan : 11.* (string)

versionType : semver (string)

}

8 : { »

status : affected (string)

version : 12.0 (string)

lessThan : 12.* (string)

versionType : semver (string)

}

9 : { »

status : affected (string)

version : 13.0 (string)

lessThan : 13.* (string)

versionType : semver (string)

}

10 : { »

status : affected (string)

version : 14.0 (string)

lessThan : 14.* (string)

versionType : semver (string)

}

11 : { »

status : affected (string)

version : 15.0 (string)

lessThan : 15.* (string)

versionType : semver (string)

}

12 : { »

status : affected (string)

version : 16.0 (string)

lessThan : 16.20.1 (string)

versionType : semver (string)

}

13 : { »

status : affected (string)

version : 17.0 (string)

lessThan : 17.* (string)

versionType : semver (string)

}

14 : { »

status : affected (string)

version : 18.0 (string)

lessThan : 18.16.1 (string)

versionType : semver (string)

}

15 : { »

status : affected (string)

version : 19.0 (string)

lessThan : 19.* (string)

versionType : semver (string)

}

16 : { »

status : affected (string)

version : 20.0 (string)

lessThan : 20.3.1 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://nodejs.org/en/blog/vulnerability/june-2023-security-releases (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js (string)

}

]

providerMetadata : { »

orgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

shortName : hackerone (string)

dateUpdated : 2025-04-30T22:24:49.919Z (string)

}

cveMetadata : { »

cveId : CVE-2023-30581 (string)

state : PUBLISHED (string)

dateUpdated : 2025-11-03T21:48:01.028Z (string)

dateReserved : 2023-04-13T01:00:12.085Z (string)

assignerOrgId : 36234546-b8fa-4601-9d6f-f4e334aa8ea1 (string)

datePublished : 2023-11-22T23:28:30.768Z (string)

assignerShortName : hackerone (string)

}

dataVersion : 5.2 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "C5D7BC2C-D9AF-4048-9D36-55BF7CB6632B", "versionEndExcluding": "16.20.1", "versionStartIncluding": "16.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "5C30F3E9-6CB7-4616-824E-A97BB69FB7E3", "versionEndExcluding": "18.16.1", "versionStartIncluding": "18.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "220A3D52-0B69-438A-B042-F19694CC63F1", "versionEndExcluding": "20.3.1", "versionStartIncluding": "20.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\n\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js"}, {"lang": "es", "value": "El uso de __proto__ en process.mainModule.__proto__.require() puede omitir el mecanismo de pol\u00edticas y requerir m\u00f3dulos fuera de la definici\u00f3n de policy.json. Esta vulnerabilidad afecta a todos los usuarios que utilizan el mecanismo de pol\u00edtica experimental en todas las l\u00edneas de lanzamiento activas: v16, v18 y v20. Tenga en cuenta que en el momento en que se emiti\u00f3 este CVE, la pol\u00edtica era una caracter\u00edstica experimental de Node.js."}], "id": "CVE-2023-30581", "lastModified": "2025-11-03T22:16:09.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-11-23T00:15:07.980", "references": [{"source": "support@hackerone.com", "tags": ["Release Notes"], "url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20241101-0011/"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* (string)

matchCriteriaId : C5D7BC2C-D9AF-4048-9D36-55BF7CB6632B (string)

versionEndExcluding : 16.20.1 (string)

versionStartIncluding : 16.0.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* (string)

matchCriteriaId : 5C30F3E9-6CB7-4616-824E-A97BB69FB7E3 (string)

versionEndExcluding : 18.16.1 (string)

versionStartIncluding : 18.0.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* (string)

matchCriteriaId : 220A3D52-0B69-438A-B042-F19694CC63F1 (string)

versionEndExcluding : 20.3.1 (string)

versionStartIncluding : 20.0.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js (string)

}

1 : { »

lang : es (string)

value : El uso de __proto__ en process.mainModule.__proto__.require() puede omitir el mecanismo de políticas y requerir módulos fuera de la definición de policy.json. Esta vulnerabilidad afecta a todos los usuarios que utilizan el mecanismo de política experimental en todas las líneas de lanzamiento activas: v16, v18 y v20. Tenga en cuenta que en el momento en que se emitió este CVE, la política era una característica experimental de Node.js. (string)

}

]

id : CVE-2023-30581 (string)

lastModified : 2025-11-03T22:16:09.510 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2023-11-23T00:15:07.980 (string)

references : [ »

0 : { »

source : support@hackerone.com (string)

tags : [ »

0 : Release Notes (string)

]

url : https://nodejs.org/en/blog/vulnerability/june-2023-security-releases (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Release Notes (string)

]

url : https://nodejs.org/en/blog/vulnerability/june-2023-security-releases (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://security.netapp.com/advisory/ntap-20241101-0011/ (string)

}

]

sourceIdentifier : support@hackerone.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-862 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2023:4536", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "nodejs:18-8080020230718130356.63b34585", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-08-08T00:00:00Z"}, {"advisory": "RHSA-2023:4537", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "nodejs:16-8080020230718141521.63b34585", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-08-08T00:00:00Z"}, {"advisory": "RHSA-2023:5361", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "nodejs:16-8060020230906023909.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-09-26T00:00:00Z"}, {"advisory": "RHSA-2023:4330", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "nodejs:18-9020020230717125503.rhel9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-07-31T00:00:00Z"}, {"advisory": "RHSA-2023:4331", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "nodejs-1:16.20.1-1.el9_2", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-07-31T00:00:00Z"}, {"advisory": "RHSA-2023:5533", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "nodejs-1:16.20.2-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2023-10-09T00:00:00Z"}], "bugzilla": {"description": "nodejs: mainModule.proto bypass experimental policy mechanism", "id": "2219824", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219824"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "verified"}, "details": ["The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js", "A vulnerability has been discovered in Node.js,  where the use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition."], "name": "CVE-2023-30581", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "nodejs:14/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Will not fix", "package_name": "rh-nodejs14-nodejs", "product_name": "Red Hat Software Collections"}], "public_date": "2023-06-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-30581\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-30581"], "threat_severity": "Moderate"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2023:4536 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : nodejs:18-8080020230718130356.63b34585 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2023-08-08T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2023:4537 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : nodejs:16-8080020230718141521.63b34585 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2023-08-08T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2023:5361 (string)

cpe : cpe:/a:redhat:rhel_eus:8.6 (string)

package : nodejs:16-8060020230906023909.ad008a3a (string)

product_name : Red Hat Enterprise Linux 8.6 Extended Update Support (string)

release_date : 2023-09-26T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2023:4330 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : nodejs:18-9020020230717125503.rhel9 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2023-07-31T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2023:4331 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : nodejs-1:16.20.1-1.el9_2 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2023-07-31T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2023:5533 (string)

cpe : cpe:/a:redhat:rhel_eus:9.0 (string)

package : nodejs-1:16.20.2-1.el9_0 (string)

product_name : Red Hat Enterprise Linux 9.0 Extended Update Support (string)

release_date : 2023-10-09T00:00:00Z (string)

}

]

bugzilla : { »

description : nodejs: mainModule.proto bypass experimental policy mechanism (string)

id : 2219824 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2219824 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 7.5 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (string)

status : verified (string)

}

details : [ »

0 : The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js (string)

1 : A vulnerability has been discovered in Node.js, where the use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition. (string)

]

name : CVE-2023-30581 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:8 (string)

fix_state : Will not fix (string)

package_name : nodejs:14/nodejs (string)

product_name : Red Hat Enterprise Linux 8 (string)

}

1 : { »

cpe : cpe:/a:redhat:rhel_software_collections:3 (string)

fix_state : Will not fix (string)

package_name : rh-nodejs14-nodejs (string)

product_name : Red Hat Software Collections (string)

}

]

public_date : 2023-06-20T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2023-30581 https://nvd.nist.gov/vuln/detail/CVE-2023-30581 (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object