01 Record

CVE-2023-30588

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could

UnratedPUBLISHEDCNA: hackerone

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 1.15% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 66.9% of scored records. A rank, not a probability.
NVD base score: 5.3 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2023-11-28 19:15Z2 YR AGO
Last updated: 2025-11-03 21:48Z11 MO AGO
Reserved: 2023-04-13
Assigning CNA: hackerone
Record state: PUBLISHED
Severity: Not rated by the issuing CNA
CNA CVSS vector: Not published by the issuing CNA
Weaknesses: No CWE assigned
Data version: 5.2
Document digest: 215bf5f3c3eb55ce916b6c1f89038da68e17d912d8ea8422353161ddc8284292

05 Affected products

VendorProductVersionsPlatforms

NodeJSNode4.0 to < 4.*, 5.0 to < 5.*, 6.0 to < 6.*, 7.0 to < 7.*, 8.0 to < 8.*, 9.0 to < 9.*, 10.0 to < 10.*, 11.0 to < 11.*, 12.0 to < 12.*, 13.0 to < 13.*, 14.0 to < 14.*, 15.0 to < 15.*, 16.0 to < 16.20.1, 17.0 to < 17.*, 18.0 to < 18.16.1, 19.0 to < 19.*, 20.0 to < 20.3.1—

06 References

nodejs.orghttps://nodejs.org/en/blog/vulnerability/june-2023-security-releases
security.netapp.comhttps://security.netapp.com/advisory/ntap-20240621-0006/
security.netapp.comhttps://security.netapp.com/advisory/ntap-20241101-0011/

07 Fixed in

AlmaLinux 8

nodejs
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
- Affected before 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-devel
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
- Affected before 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-docs
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
- Affected before 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-full-i18n
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
- Affected before 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-nodemon
Fixed

A version is affected if any line below covers it.
- Affected before 2.0.20-2.module_el8.8.0+3587+ee652244
- Affected before 2.0.20-3.module_el8.8.0+3586+d4fc0b72
nodejs-packaging
Fixed

A version is affected if any line below covers it.
- Affected before 2021.06-4.module_el8.7.0+3343+ea2b7901
- Affected before 25-1.module_el8.5.0+2605+45d748af
nodejs-packaging-bundler
Fixed in 2021.06-4.module_el8.7.0+3343+ea2b7901
npm
Fixed

A version is affected if any line below covers it.
- Affected before 1:8.19.4-1.16.20.1.1.module_el8.8.0+3594+e74fe53f
- Affected before 1:9.5.1-1.18.16.1.1.module_el8.8.0+3595+0818e803

AlmaLinux 9

nodejs
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.el9_2
- Affected before 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-devel
Fixed in 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-docs
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.el9_2
- Affected before 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-full-i18n
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.el9_2
- Affected before 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-libs
Fixed in 1:16.20.1-1.el9_2
nodejs-nodemon
Fixed in 2.0.20-2.module_el9.2.0+29+de583a0b
nodejs-packaging
Fixed in 2021.06-4.module_el9.1.0+13+d9a595ea
nodejs-packaging-bundler
Fixed in 2021.06-4.module_el9.1.0+13+d9a595ea
npm
Fixed

A version is affected if any line below covers it.
- Affected before 1:8.19.4-1.16.20.1.1.el9_2
- Affected before 1:9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8e

CloudLinux 8

nodejs
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
- Affected before 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-devel
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
- Affected before 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-docs
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
- Affected before 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-full-i18n
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.module_el8.8.0+3594+e74fe53f
- Affected before 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-nodemon
Fixed

A version is affected if any line below covers it.
- Affected before 2.0.20-2.module_el8.8.0+3587+ee652244
- Affected before 2.0.20-3.module_el8.8.0+3586+d4fc0b72
nodejs-packaging
Fixed

A version is affected if any line below covers it.
- Affected before 2021.06-4.module_el8.7.0+3343+ea2b7901
- Affected before 25-1.module_el8.5.0+2605+45d748af
nodejs-packaging-bundler
Fixed in 2021.06-4.module_el8.7.0+3343+ea2b7901
npm
Fixed

A version is affected if any line below covers it.
- Affected before 1:8.19.4-1.16.20.1.1.module_el8.8.0+3594+e74fe53f
- Affected before 1:9.5.1-1.18.16.1.1.module_el8.8.0+3595+0818e803

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

CloudLinux 9

nodejs
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.el9_2
- Affected before 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-devel
Fixed in 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-docs
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.el9_2
- Affected before 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-full-i18n
Fixed

A version is affected if any line below covers it.
- Affected before 1:16.20.1-1.el9_2
- Affected before 1:18.16.1-1.module_el9.2.0+31+cbae0c8e
nodejs-libs
Fixed in 1:16.20.1-1.el9_2
nodejs-nodemon
Fixed in 2.0.20-2.module_el9.2.0+29+de583a0b
nodejs-packaging
Fixed in 2021.06-4.module_el9.1.0+13+d9a595ea
nodejs-packaging-bundler
Fixed in 2021.06-4.module_el9.1.0+13+d9a595ea
npm
Fixed

A version is affected if any line below covers it.
- Affected before 1:8.19.4-1.16.20.1.1.el9_2
- Affected before 1:9.5.1-1.18.16.1.1.module_el9.2.0+31+cbae0c8e

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

Debian 12

nodejs
Fixed in 18.19.0+dfsg-6~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

nodejs
Fixed in 18.13.0+dfsg1-1.1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

nodejs
Fixed in 18.13.0+dfsg1-1.1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.