# CVE-2023-23918: Node.js 14 and 3 others: Incorrect Authorization

CVE-2023-23918 is fixed in 17 products on 2 platforms, first by Node.js 14 14.21.3, released February 16, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-23918
- Priority: High
- CVSS: 8.6 (Important)
- EPSS: 0.0202
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 23, 2023
- Weakness: CWE-863: Incorrect Authorization
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-23918

## Description

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 14 | 14.21.3 | [Node.js 14 14.21.3](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.14-14.21.3.md) | Feb 16, 2023 |
| Windows apps | Node.js 16 | 16.19.1 | [Node.js 16 16.19.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.16-16.19.1.md) | Feb 16, 2023 |
| Windows apps | Node.js 18 | 18.14.1 | [Node.js 18 18.14.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.18-18.14.1.md) | Feb 16, 2023 |
| Windows apps | Node.js 19 | 19.6.1 | [Node.js 19 19.6.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.19-19.6.1.md) | Feb 16, 2023 |
| Linux | nodejs Debian 12.15 (bookworm) | 18.19.0+dfsg-6~deb12u1 | [DSA-5589-1](https://patchblox.com/security/data/fix/linux/dsa-5589-1.md) | Dec 27, 2023 |
| Linux | nodejs Debian 13.5 (trixie) | 18.19.0+dfsg-2 | [DEBIAN-CVE-2023-23918](https://patchblox.com/security/data/fix/linux/debian-cve-2023-23918.md) | Feb 23, 2023 |
| Linux | nodejs Debian 14 | 18.19.0+dfsg-2 | [DEBIAN-CVE-2023-23918](https://patchblox.com/security/data/fix/linux/debian-cve-2023-23918.md) | Feb 23, 2023 |
| Linux | nodejs RHEL 8 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs almalinux 8 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs rocky 8 | 1:14.21.3-1.module+el8.7.0+1183+c2c35f0a | [RLSA-2023:1743](https://patchblox.com/security/data/fix/linux/rlsa-2023-1743.md) | Apr 26, 2023 |
| Linux | nodejs rocky 9 | 1:16.19.1-1.el9_2 | [RLSA-2023:2655](https://patchblox.com/security/data/fix/linux/rlsa-2023-2655.md) | May 25, 2023 |
| Linux | nodejs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-debugsource amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-devel RHEL 8 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-devel RHEL 9 | 1:18.14.2-2.module+el9.2.0.z+18497+a402347c | [RHSA-2023:2654](https://patchblox.com/security/data/fix/linux/rhsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-devel almalinux 8 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-devel almalinux 9 | 1:18.14.2-2.module_el9.2.0+29+de583a0b | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-devel amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-devel ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-devel ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-docs RHEL 8 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-docs RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-docs almalinux 8 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-docs almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-docs amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-docs ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-docs ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-full-i18n RHEL 8 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-full-i18n RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-full-i18n almalinux 8 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-full-i18n almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-full-i18n amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-full-i18n ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-full-i18n ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-libs RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-libs almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-libs amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-libs ol 9 | 1:16.19.1-1.el9_2 | [ELSA-2023-2655](https://patchblox.com/security/data/fix/linux/elsa-2023-2655.md) | May 17, 2023 |
| Linux | nodejs-libs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | nodejs-nodemon RHEL 8 | 0:2.0.20-3.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-nodemon RHEL 9 | 0:2.0.20-3.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-nodemon almalinux 8 | 2.0.20-3.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-nodemon almalinux 9 | 2.0.20-2.module_el9.2.0+29+de583a0b | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-nodemon ol 8 | 0:2.0.20-3.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-nodemon ol 9 | 0:2.0.20-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-nodemon rocky 8 | 0:2.0.20-3.module+el8.7.0+1178+d52dba78 | [RLSA-2023:1743](https://patchblox.com/security/data/fix/linux/rlsa-2023-1743.md) | Apr 26, 2023 |
| Linux | nodejs-nodemon rocky 9 | 0:2.0.20-3.el9_2 | [RLSA-2023:2655](https://patchblox.com/security/data/fix/linux/rlsa-2023-2655.md) | May 25, 2023 |
| Linux | nodejs-packaging RHEL 8 | 0:23-3.module+el8.3.0+6519+9f98ed83 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-packaging RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:2654](https://patchblox.com/security/data/fix/linux/rhsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging almalinux 8 | 23-3.module_el8.4.0+2522+3bd42762 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-packaging almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging ol 8 | 0:23-3.module+el8.3.0+7818+6cd30d85 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-packaging ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-packaging rocky 8 | 0:23-3.module+el8.7.0+1071+4bdda2a8 | [RLSA-2023:1743](https://patchblox.com/security/data/fix/linux/rlsa-2023-1743.md) | Apr 26, 2023 |
| Linux | nodejs-packaging rocky 9 | 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2 | [RLSA-2023:2654](https://patchblox.com/security/data/fix/linux/rlsa-2023-2654.md) | Dec 3, 2025 |
| Linux | nodejs-packaging-bundler RHEL 8 | 0:2021.06-4.module+el8.7.0+15582+19c314fa | [RHSA-2023:1583](https://patchblox.com/security/data/fix/linux/rhsa-2023-1583.md) | Apr 4, 2023 |
| Linux | nodejs-packaging-bundler RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:2654](https://patchblox.com/security/data/fix/linux/rhsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging-bundler almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | [ALSA-2023:1583](https://patchblox.com/security/data/fix/linux/alsa-2023-1583.md) | Apr 4, 2023 |
| Linux | nodejs-packaging-bundler almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging-bundler ol 8 | 0:2021.06-4.module+el8.7.0+20766+0a247725 | [ELSA-2023-1583](https://patchblox.com/security/data/fix/linux/elsa-2023-1583.md) | Apr 5, 2023 |
| Linux | nodejs-packaging-bundler ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | npm RHEL 8 | 1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | npm RHEL 9 | 1:8.19.3-1.16.19.1.1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | npm almalinux 8 | 1:6.14.18-1.14.21.3.1.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | npm almalinux 9 | 1:8.19.3-1.16.19.1.1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | npm amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |
| Linux | npm ol 8 | 1:6.14.18-1.14.21.3.1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | npm ol 9 | 1:9.5.0-1.18.14.2.2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | v8-devel amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.6 | [ALAS2023-2023-243](https://patchblox.com/security/data/fix/linux/alas2023-2023-243.md) | Jul 5, 2023 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.