Description
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.
This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NodeJS | Node | 4.0 – < 4.*, 5.0 – < 5.*, 6.0 – < 6.*, 7.0 – < 7.*, 8.0 – < 8.*, 9.0 – < 9.*, 10.0 – < 10.*, 11.0 – < 11.*, 12.0 – < 12.*, 13.0 – < 13.*, 14.0 – < 14.*, 15.0 – < 15.*, 16.0 – < 16.*, 17.0 – < 17.*, 19.0 – < 19.*, 20.0 – < 20.8.1 | 4.* |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nodejs +3 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | RHSA-2023:7205 |
| RHEL 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+20473+c4e3d824 | RHSA-2023:7205 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-4.module+el8.9.0+19519+e25b965a | RHSA-2023:7205 |
| RHEL 8 | npm | 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824 | RHSA-2023:7205 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nodejs +3 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux 8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2023:7205 |
| AlmaLinux 8 | npm | 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 | ALSA-2023:7205 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2023:7205 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2023:7205 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nodejs20 | 20.8.1-1.1 | openSUSE-SU-2024:13337-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nodejs-current | 20.8.1-r0 | — |
| Alpine v3.23 | nodejs-current | 20.8.1-r0 | — |
| Alpine v3.22 | nodejs-current | 20.8.1-r0 | — |
| Alpine v3.21 | nodejs-current | 20.8.1-r0 | — |
| Alpine v3.20 | nodejs-current | 20.8.1-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nodejs-current | 20.8.1-r0 | — |
| Alpine v3.18 | nodejs-current | 20.8.1-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nodejs +3 | 1:20.8.1-1.module+el8.9.0+90082+b6a613a6 | ELSA-2023-7205 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+90082+b6a613a6 | ELSA-2023-7205 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-4.module+el8.9.0+90082+b6a613a6 | ELSA-2023-7205 |
| Oracle Linux 8 | npm | 1:10.1.0-1.20.8.1.1.module+el8.9.0+90082+b6a613a6 | ELSA-2023-7205 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | nodejs-20 | 20.8.0-r0 | — |
Advisories 9
- ALSA-2023:7205 Important: nodejs:20 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:7205 Red Hat Security Advisory: nodejs:20 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RLSA-2023:7205 Important: nodejs:20 security update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2024:13337-1 corepack20-20.8.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2655 Node.js: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 3, 2025
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- SSA-915275 SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3 Siemens ProductCERT · Nov 12, 2024
- ICSA-24-319-08 Siemens SINEC INS CISA ICS & IT advisories · Nov 12, 2024
- ELSA-2023-7205 Important: nodejs:20 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 22, 2023