CVE-2023-30590
Node.js 16 and 2 others: The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or…
CVE-2023-30590 is fixed in 40 products on 2 platforms, first by Node.js 16 16.20.1, released June 20, 2023. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 2 platforms
CVSS
7.5
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0146
73rd percentile
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 16 | 16.20.1 | Node.js 16 16.20.1 | Jun 20, 2023 |
| Node.js 18 | 18.16.1 | Node.js 18 18.16.1 | Jun 20, 2023 |
| Node.js 20 | 20.3.1 | Node.js 20 20.3.1 | Jun 20, 2023 |
| Linux | |||
| graalvm-community-17-espresso · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-espresso · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-espresso-llvm · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-espresso-llvm · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12943 | Oct 24, 2023 |
| graalvm-community-17-icu4j · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-icu4j · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-javascript · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-javascript · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-jdk · ol 8 | 0:17.0.9-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-jdk · ol 9 | 0:17.0.9-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-libpolyglot · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-libpolyglot · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-llvm · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-llvm · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-llvm-toolchain · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-llvm-toolchain · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-native-image · ol 8 | 0:17.0.9-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-native-image · ol 9 | 0:17.0.9-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-native-image-llvm-backend · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-native-image-llvm-backend · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-nodejs · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-nodejs · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-nodejs-devel · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-nodejs-devel · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-polyglot · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-polyglot · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-python · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-python · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-python-devel · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-python-devel · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-regex · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-regex · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-ruby · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-ruby · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-ruby-devel · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-ruby-devel · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-tools · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-tools · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-17-wasm · ol 8 | 0:23.0.2-1.el8 | ELSA-2023-12940 | Oct 24, 2023 |
| graalvm-community-17-wasm · ol 9 | 0:23.0.2-1.el9 | ELSA-2023-12944 | Oct 24, 2023 |
| graalvm-community-21-jdk · ol 8 | 0:21.0.1-1.el8 | ELSA-2023-12938 | Oct 24, 2023 |
| graalvm-community-21-jdk · ol 9 | 0:21.0.1-1.el9 | ELSA-2023-12941 | Oct 24, 2023 |
| graalvm-community-21-native-image · ol 8 | 0:21.0.1-1.el8 | ELSA-2023-12938 | Oct 24, 2023 |
| graalvm-community-21-native-image · ol 9 | 0:21.0.1-1.el9 | ELSA-2023-12941 | Oct 24, 2023 |
| libnode64 · Ubuntu 20.04 LTS (focal) | 10.19.0~dfsg-3ubuntu1.6 | libnode64 10.19.0~dfsg-3ubuntu1.6 | Nov 28, 2023 |
| libnode72 · Ubuntu 22.04.1 LTS (jammy) | 12.22.9~dfsg-1ubuntu3.5 | libnode72 12.22.9~dfsg-1ubuntu3.5 | Nov 28, 2023 |
| nodejs · Debian 12.15 (bookworm) | 18.19.0+dfsg-6~deb12u1 | DEBIAN-CVE-2023-30590 | Nov 28, 2023 |
| nodejs · Debian 13.5 (trixie) | 18.13.0+dfsg1-1.1 | DEBIAN-CVE-2023-30590 | Nov 28, 2023 |
| nodejs · Debian 14 | 18.13.0+dfsg1-1.1 | DEBIAN-CVE-2023-30590 | Nov 28, 2023 |
| nodejs · RHEL 8 | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 | RHSA-2023:4537 | Aug 8, 2023 |
| nodejs · RHEL 9 | 1:16.20.1-1.el9_2 | RHSA-2023:4331 | Jul 31, 2023 |
| nodejs · Ubuntu 18.04.6 LTS (bionic) | 8.10.0~dfsg-2ubuntu0.4+esm5 | nodejs 8.10.0~dfsg-2ubuntu0.4+esm5 | Nov 28, 2023 |
| nodejs · Ubuntu 20.04 LTS (focal) | 10.19.0~dfsg-3ubuntu1.6 | nodejs 10.19.0~dfsg-3ubuntu1.6 | Nov 28, 2023 |
| nodejs · Ubuntu 22.04.1 LTS (jammy) | 12.22.9~dfsg-1ubuntu3.5 | nodejs 12.22.9~dfsg-1ubuntu3.5 | Nov 28, 2023 |
| nodejs · almalinux 8 | 1:16.20.1-1.module_el8.8.0+3594+e74fe53f | ALSA-2023:4537 | Aug 8, 2023 |
| nodejs · almalinux 9 | 1:16.20.1-1.el9_2 | ALSA-2023:4331 | Jul 31, 2023 |
| nodejs · amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | ALAS2023-2023-237 | Jul 5, 2023 |
| nodejs · ol 8 | 1:16.20.1-1.module+el8.8.0+21143+178952bb | ELSA-2023-4537 | Aug 10, 2023 |
| nodejs · ol 9 | 1:18.16.1-1.module+el9.2.0+21133+486db26c | ELSA-2023-4330 | Aug 2, 2023 |
| nodejs · rocky 8 | 1:18.16.1-1.module+el8.8.0+1413+a47876c7 | RLSA-2023:4536 | Oct 6, 2023 |
| nodejs-debuginfo · amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | ALAS2023-2023-237 | Jul 5, 2023 |
| nodejs-debugsource · amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | ALAS2023-2023-237 | Jul 5, 2023 |
| nodejs-devel · RHEL 8 | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 | RHSA-2023:4537 | Aug 8, 2023 |
| nodejs-devel · RHEL 9 | 1:18.16.1-1.module+el9.2.0.z+19424+78951f07 | RHSA-2023:4330 | Jul 31, 2023 |
| nodejs-devel · almalinux 8 | 1:16.20.1-1.module_el8.8.0+3594+e74fe53f | ALSA-2023:4537 | Aug 8, 2023 |
| nodejs-devel · almalinux 9 | 1:18.16.1-1.module_el9.2.0+31+cbae0c8e | ALSA-2023:4330 | Jul 31, 2023 |
| nodejs-devel · amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | ALAS2023-2023-237 | Jul 5, 2023 |
| nodejs-devel · ol 8 | 1:16.20.1-1.module+el8.8.0+21143+178952bb | ELSA-2023-4537 | Aug 10, 2023 |
| nodejs-devel · ol 9 | 1:18.16.1-1.module+el9.2.0+21133+486db26c | ELSA-2023-4330 | Aug 2, 2023 |
| nodejs-docs · RHEL 8 | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 | RHSA-2023:4537 | Aug 8, 2023 |
| nodejs-docs · RHEL 9 | 1:16.20.1-1.el9_2 | RHSA-2023:4331 | Jul 31, 2023 |
| nodejs-docs · almalinux 8 | 1:16.20.1-1.module_el8.8.0+3594+e74fe53f | ALSA-2023:4537 | Aug 8, 2023 |
| nodejs-docs · almalinux 9 | 1:16.20.1-1.el9_2 | ALSA-2023:4331 | Jul 31, 2023 |
| nodejs-docs · amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | ALAS2023-2023-237 | Jul 5, 2023 |
| nodejs-docs · ol 8 | 1:16.20.1-1.module+el8.8.0+21143+178952bb | ELSA-2023-4537 | Aug 10, 2023 |
| nodejs-docs · ol 9 | 1:18.16.1-1.module+el9.2.0+21133+486db26c | ELSA-2023-4330 | Aug 2, 2023 |
| nodejs-full-i18n · RHEL 8 | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 | RHSA-2023:4537 | Aug 8, 2023 |
| nodejs-full-i18n · RHEL 9 | 1:16.20.1-1.el9_2 | RHSA-2023:4331 | Jul 31, 2023 |
| nodejs-full-i18n · almalinux 8 | 1:16.20.1-1.module_el8.8.0+3594+e74fe53f | ALSA-2023:4537 | Aug 8, 2023 |
| nodejs-full-i18n · almalinux 9 | 1:16.20.1-1.el9_2 | ALSA-2023:4331 | Jul 31, 2023 |
| nodejs-full-i18n · amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | ALAS2023-2023-237 | Jul 5, 2023 |
| nodejs-full-i18n · ol 8 | 1:16.20.1-1.module+el8.8.0+21143+178952bb | ELSA-2023-4537 | Aug 10, 2023 |
| nodejs-full-i18n · ol 9 | 1:18.16.1-1.module+el9.2.0+21133+486db26c | ELSA-2023-4330 | Aug 2, 2023 |
| nodejs-libs · RHEL 9 | 1:16.20.1-1.el9_2 | RHSA-2023:4331 | Jul 31, 2023 |
| nodejs-libs · almalinux 9 | 1:16.20.1-1.el9_2 | ALSA-2023:4331 | Jul 31, 2023 |
| nodejs-libs · amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | ALAS2023-2023-237 | Jul 5, 2023 |
| nodejs-libs · ol 9 | 1:16.20.1-1.el9_2 | ELSA-2023-4331 | Aug 2, 2023 |
| nodejs-libs-debuginfo · amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | ALAS2023-2023-237 | Jul 5, 2023 |
| nodejs-nodemon · RHEL 8 | 0:2.0.20-3.module+el8.8.0+19038+6f60344f | RHSA-2023:4537 | Aug 8, 2023 |
| nodejs-nodemon · RHEL 9 | 0:2.0.20-2.module+el9.2.0.z+18497+a402347c | RHSA-2023:4330 | Jul 31, 2023 |
| nodejs-nodemon · almalinux 8 | 2.0.20-3.module_el8.8.0+3586+d4fc0b72 | ALSA-2023:4537 | Aug 8, 2023 |
| nodejs-nodemon · almalinux 9 | 2.0.20-2.module_el9.2.0+29+de583a0b | ALSA-2023:4330 | Jul 31, 2023 |
| nodejs-nodemon · ol 8 | 0:2.0.20-3.module+el8.8.0+21143+178952bb | ELSA-2023-4537 | Aug 10, 2023 |
| nodejs-nodemon · ol 9 | 0:2.0.20-2.module+el9.2.0+21038+115df6a2 | ELSA-2023-4330 | Aug 2, 2023 |
| nodejs-nodemon · rocky 8 | 0:2.0.20-2.module+el8.7.0+1177+510ae886 | RLSA-2023:4536 | Oct 6, 2023 |
| nodejs-packaging · RHEL 8 | 0:25-1.module+el8.5.0+10992+fac5fe06 | RHSA-2023:4537 | Aug 8, 2023 |
| nodejs-packaging · RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | RHSA-2023:4330 | Jul 31, 2023 |
| nodejs-packaging · almalinux 8 | 25-1.module_el8.5.0+2605+45d748af | ALSA-2023:4537 | Aug 8, 2023 |
| nodejs-packaging · almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2023:4330 | Jul 31, 2023 |
| nodejs-packaging · ol 8 | 0:25-1.module+el8.5.0+20388+4b61e68d | ELSA-2023-4537 | Aug 10, 2023 |
| nodejs-packaging · ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | ELSA-2023-4330 | Aug 2, 2023 |
| nodejs-packaging · rocky 8 | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2023:4536 | Oct 6, 2023 |
| nodejs-packaging · rocky 9 | 0:2021.06-4.module+el9.7.0+40022+9ecc286c | RLSA-2023:4330 | Nov 8, 2026 |
| nodejs-packaging-bundler · RHEL 8 | 0:2021.06-4.module+el8.7.0+15582+19c314fa | RHSA-2023:4536 | Aug 8, 2023 |
| nodejs-packaging-bundler · RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | RHSA-2023:4330 | Jul 31, 2023 |
| nodejs-packaging-bundler · almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2023:4536 | Aug 8, 2023 |
| nodejs-packaging-bundler · almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2023:4330 | Jul 31, 2023 |
| nodejs-packaging-bundler · ol 8 | 0:2021.06-4.module+el8.7.0+20766+0a247725 | ELSA-2023-4536 | Aug 10, 2023 |
| nodejs-packaging-bundler · ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | ELSA-2023-4330 | Aug 2, 2023 |
| npm · RHEL 8 | 1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5 | RHSA-2023:4537 | Aug 8, 2023 |
| npm · RHEL 9 | 1:8.19.4-1.16.20.1.1.el9_2 | RHSA-2023:4331 | Jul 31, 2023 |
| npm · almalinux 8 | 1:8.19.4-1.16.20.1.1.module_el8.8.0+3594+e74fe53f | ALSA-2023:4537 | Aug 8, 2023 |
| npm · almalinux 9 | 1:8.19.4-1.16.20.1.1.el9_2 | ALSA-2023:4331 | Jul 31, 2023 |
| npm · amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.7 | ALAS2023-2023-237 | Jul 5, 2023 |
| npm · ol 8 | 1:8.19.4-1.16.20.1.1.module+el8.8.0+21143+178952bb | ELSA-2023-4537 | Aug 10, 2023 |
| npm · ol 9 | 1:9.5.1-1.18.16.1.1.module+el9.2.0+21133+486db26c | ELSA-2023-4330 | Aug 2, 2023 |
| v8-devel · amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.7 | ALAS2023-2023-237 | Jul 5, 2023 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.