CVE-2023-32002
HackerOne: CVE-2023-32002 Node.js `Module._load()` policy Remote Code Execution Vulnerability
CVE-2023-32002 is fixed in 17 products on 2 platforms, first by Node.js 16 16.20.2, released August 8, 2023. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 2 platforms
CVSS
9.8
Important
Exploitation
None reported
Exploitation Unlikely
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0161
76th percentile
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 16 | 16.20.2 | Node.js 16 16.20.2 | Aug 8, 2023 |
| Node.js 18 | 18.17.1 | Node.js 18 18.17.1 | Aug 8, 2023 |
| Node.js 20 | 20.5.1 | Node.js 20 20.5.1 | Aug 9, 2023 |
| Linux | |||
| libnode72 · Ubuntu 22.04.1 LTS (jammy) | 12.22.9~dfsg-1ubuntu3.6 | libnode72 12.22.9~dfsg-1ubuntu3.6 | Aug 23, 2023 |
| nodejs · Debian 12.15 (bookworm) | 18.19.0+dfsg-6~deb12u1 | DEBIAN-CVE-2023-32002 | Aug 21, 2023 |
| nodejs · Debian 13.5 (trixie) | 18.13.0+dfsg1-1.1 | DEBIAN-CVE-2023-32002 | Aug 21, 2023 |
| nodejs · Debian 14 | 18.13.0+dfsg1-1.1 | DEBIAN-CVE-2023-32002 | Aug 21, 2023 |
| nodejs · RHEL 8 | 1:18.17.1-1.module+el8.8.0+19757+8ca87034 | RHSA-2023:5362 | Sep 26, 2023 |
| nodejs · RHEL 9 | 1:16.20.2-1.el9_2 | RHSA-2023:5532 | Oct 9, 2023 |
| nodejs · Ubuntu 22.04.1 LTS (jammy) | 12.22.9~dfsg-1ubuntu3.6 | nodejs 12.22.9~dfsg-1ubuntu3.6 | Aug 23, 2023 |
| nodejs · almalinux 8 | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2023:5362 | Sep 26, 2023 |
| nodejs · almalinux 9 | 1:16.20.2-1.el9_2 | ALSA-2023:5532 | Oct 9, 2023 |
| nodejs · amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | ALAS2023-2023-304 | Aug 17, 2023 |
| nodejs · ol 8 | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 | ELSA-2023-5362 | Sep 28, 2023 |
| nodejs · ol 9 | 1:16.20.2-1.el9_2 | ELSA-2023-5532 | Oct 10, 2023 |
| nodejs · rocky 9 | 1:16.20.2-1.el9_2 | RLSA-2023:5532 | Oct 14, 2023 |
| nodejs-debuginfo · amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | ALAS2023-2023-304 | Aug 17, 2023 |
| nodejs-debugsource · amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | ALAS2023-2023-304 | Aug 17, 2023 |
| nodejs-devel · RHEL 8 | 1:18.17.1-1.module+el8.8.0+19757+8ca87034 | RHSA-2023:5362 | Sep 26, 2023 |
| nodejs-devel · RHEL 9 | 1:18.17.1-1.module+el9.2.0.z+19753+58118bc0 | RHSA-2023:5363 | Sep 26, 2023 |
| nodejs-devel · almalinux 8 | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2023:5362 | Sep 26, 2023 |
| nodejs-devel · almalinux 9 | 1:18.17.1-1.module_el9.2.0+36+853e48f5 | ALSA-2023:5363 | Sep 26, 2023 |
| nodejs-devel · amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | ALAS2023-2023-304 | Aug 17, 2023 |
| nodejs-devel · ol 8 | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 | ELSA-2023-5362 | Sep 28, 2023 |
| nodejs-devel · ol 9 | 1:18.17.1-1.module+el9.2.0+21169+1d24b6cc | ELSA-2023-5363 | Oct 5, 2023 |
| nodejs-docs · RHEL 8 | 1:18.17.1-1.module+el8.8.0+19757+8ca87034 | RHSA-2023:5362 | Sep 26, 2023 |
| nodejs-docs · RHEL 9 | 1:16.20.2-1.el9_2 | RHSA-2023:5532 | Oct 9, 2023 |
| nodejs-docs · almalinux 8 | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2023:5362 | Sep 26, 2023 |
| nodejs-docs · almalinux 9 | 1:16.20.2-1.el9_2 | ALSA-2023:5532 | Oct 9, 2023 |
| nodejs-docs · amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | ALAS2023-2023-304 | Aug 17, 2023 |
| nodejs-docs · ol 8 | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 | ELSA-2023-5362 | Sep 28, 2023 |
| nodejs-docs · ol 9 | 1:16.20.2-1.el9_2 | ELSA-2023-5532 | Oct 10, 2023 |
| nodejs-full-i18n · RHEL 8 | 1:18.17.1-1.module+el8.8.0+19757+8ca87034 | RHSA-2023:5362 | Sep 26, 2023 |
| nodejs-full-i18n · RHEL 9 | 1:16.20.2-1.el9_2 | RHSA-2023:5532 | Oct 9, 2023 |
| nodejs-full-i18n · almalinux 8 | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2023:5362 | Sep 26, 2023 |
| nodejs-full-i18n · almalinux 9 | 1:16.20.2-1.el9_2 | ALSA-2023:5532 | Oct 9, 2023 |
| nodejs-full-i18n · amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | ALAS2023-2023-304 | Aug 17, 2023 |
| nodejs-full-i18n · ol 8 | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 | ELSA-2023-5362 | Sep 28, 2023 |
| nodejs-full-i18n · ol 9 | 1:16.20.2-1.el9_2 | ELSA-2023-5532 | Oct 10, 2023 |
| nodejs-libs · RHEL 9 | 1:16.20.2-1.el9_2 | RHSA-2023:5532 | Oct 9, 2023 |
| nodejs-libs · almalinux 9 | 1:16.20.2-1.el9_2 | ALSA-2023:5532 | Oct 9, 2023 |
| nodejs-libs · amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | ALAS2023-2023-304 | Aug 17, 2023 |
| nodejs-libs · ol 9 | 1:16.20.2-1.el9_2 | ELSA-2023-5532 | Oct 10, 2023 |
| nodejs-libs-debuginfo · amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | ALAS2023-2023-304 | Aug 17, 2023 |
| nodejs-nodemon · RHEL 8 | 0:3.0.1-1.module+el8.8.0+19757+8ca87034 | RHSA-2023:5362 | Sep 26, 2023 |
| nodejs-nodemon · RHEL 9 | 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0 | RHSA-2023:5363 | Sep 26, 2023 |
| nodejs-nodemon · almalinux 8 | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2023:5362 | Sep 26, 2023 |
| nodejs-nodemon · almalinux 9 | 3.0.1-1.module_el9.2.0+36+853e48f5 | ALSA-2023:5363 | Sep 26, 2023 |
| nodejs-nodemon · ol 8 | 0:3.0.1-1.module+el8.8.0+21170+2efec6d4 | ELSA-2023-5362 | Sep 28, 2023 |
| nodejs-nodemon · ol 9 | 0:3.0.1-1.module+el9.2.0+21169+1d24b6cc | ELSA-2023-5363 | Oct 5, 2023 |
| nodejs-nodemon · rocky 8 | 0:3.0.1-1.module+el8.10.0+1667+4a788d89 | RLSA-2023:5362 | Dec 20, 2025 |
| nodejs-nodemon · rocky 9 | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2023:5363 | Oct 5, 2023 |
| nodejs-packaging · RHEL 8 | 0:2021.06-4.module+el8.7.0+15582+19c314fa | RHSA-2023:5362 | Sep 26, 2023 |
| nodejs-packaging · RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | RHSA-2023:5363 | Sep 26, 2023 |
| nodejs-packaging · almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2023:5362 | Sep 26, 2023 |
| nodejs-packaging · almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2023:5363 | Sep 26, 2023 |
| nodejs-packaging · ol 8 | 0:2021.06-4.module+el8.7.0+20766+0a247725 | ELSA-2023-5362 | Sep 28, 2023 |
| nodejs-packaging · ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | ELSA-2023-5363 | Oct 5, 2023 |
| nodejs-packaging · rocky 8 | 0:2021.06-4.module+el8.10.0+1924+614dc87f | RLSA-2023:5362 | Dec 20, 2025 |
| nodejs-packaging · rocky 9 | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2023:5363 | Oct 5, 2023 |
| nodejs-packaging-bundler · RHEL 8 | 0:2021.06-4.module+el8.7.0+15582+19c314fa | RHSA-2023:5362 | Sep 26, 2023 |
| nodejs-packaging-bundler · RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | RHSA-2023:5363 | Sep 26, 2023 |
| nodejs-packaging-bundler · almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2023:5362 | Sep 26, 2023 |
| nodejs-packaging-bundler · almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2023:5363 | Sep 26, 2023 |
| nodejs-packaging-bundler · ol 8 | 0:2021.06-4.module+el8.7.0+20766+0a247725 | ELSA-2023-5362 | Sep 28, 2023 |
| nodejs-packaging-bundler · ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | ELSA-2023-5363 | Oct 5, 2023 |
| npm · RHEL 8 | 1:9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034 | RHSA-2023:5362 | Sep 26, 2023 |
| npm · RHEL 9 | 1:8.19.4-1.16.20.2.1.el9_2 | RHSA-2023:5532 | Oct 9, 2023 |
| npm · almalinux 8 | 1:9.6.7-1.18.17.1.1.module_el8.8.0+3613+1ed8c91d | ALSA-2023:5362 | Sep 26, 2023 |
| npm · almalinux 9 | 1:8.19.4-1.16.20.2.1.el9_2 | ALSA-2023:5532 | Oct 9, 2023 |
| npm · amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.10 | ALAS2023-2023-304 | Aug 17, 2023 |
| npm · ol 8 | 1:9.6.7-1.18.17.1.1.module+el8.8.0+21170+2efec6d4 | ELSA-2023-5362 | Sep 28, 2023 |
| npm · ol 9 | 1:8.19.4-1.16.20.2.1.el9_2 | ELSA-2023-5532 | Oct 10, 2023 |
| v8-devel · amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.10 | ALAS2023-2023-304 | Aug 17, 2023 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.