# CVE-2023-23920: Node.js 14 and 3 others: Untrusted Search Path (CWE-426)

CVE-2023-23920 is fixed in 19 products on 2 platforms, first by Node.js 14 14.21.3, released February 16, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-23920
- Priority: High
- CVSS: 8.6 (Important)
- EPSS: 0.0045
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 23, 2023
- Weakness: CWE-426: Untrusted Search Path (CWE-426)
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-23920

## Description

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 14 | 14.21.3 | [Node.js 14 14.21.3](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.14-14.21.3.md) | Feb 16, 2023 |
| Windows apps | Node.js 16 | 16.19.1 | [Node.js 16 16.19.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.16-16.19.1.md) | Feb 16, 2023 |
| Windows apps | Node.js 18 | 18.14.1 | [Node.js 18 18.14.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.18-18.14.1.md) | Feb 16, 2023 |
| Windows apps | Node.js 19 | 19.6.1 | [Node.js 19 19.6.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.19-19.6.1.md) | Feb 16, 2023 |
| Linux | libnode64 Ubuntu 20.04 LTS (focal) | 10.19.0~dfsg-3ubuntu1.5 | [libnode64 10.19.0~dfsg-3ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libnode64-10.19.0-dfsg-3ubuntu1.5.md) | Feb 23, 2023 |
| Linux | libnode72 Ubuntu 22.04.1 LTS (jammy) | 12.22.9~dfsg-1ubuntu3.4 | [libnode72 12.22.9~dfsg-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libnode72-12.22.9-dfsg-1ubuntu3.4.md) | May 29, 2023 |
| Linux | nodejs Debian 11.6 (bullseye) | 12.22.12~dfsg-1~deb11u4 | [DSA-5395-1](https://patchblox.com/security/data/fix/linux/dsa-5395-1.md) | May 2, 2023 |
| Linux | nodejs Debian 12.15 (bookworm) | 18.19.0+dfsg-6~deb12u1 | [DEBIAN-CVE-2023-23920](https://patchblox.com/security/data/fix/linux/debian-cve-2023-23920.md) | Feb 23, 2023 |
| Linux | nodejs Debian 13.5 (trixie) | 18.13.0+dfsg1-1.1 | [DEBIAN-CVE-2023-23920](https://patchblox.com/security/data/fix/linux/debian-cve-2023-23920.md) | Feb 23, 2023 |
| Linux | nodejs Debian 14 | 18.13.0+dfsg1-1.1 | [DEBIAN-CVE-2023-23920](https://patchblox.com/security/data/fix/linux/debian-cve-2023-23920.md) | Feb 23, 2023 |
| Linux | nodejs RHEL 8 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs Ubuntu 20.04 LTS (focal) | 10.19.0~dfsg-3ubuntu1.5 | [nodejs 10.19.0~dfsg-3ubuntu1.5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-nodejs-10.19.0-dfsg-3ubuntu1.5.md) | Feb 23, 2023 |
| Linux | nodejs Ubuntu 22.04.1 LTS (jammy) | 12.22.9~dfsg-1ubuntu3.4 | [nodejs 12.22.9~dfsg-1ubuntu3.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-nodejs-12.22.9-dfsg-1ubuntu3.4.md) | May 29, 2023 |
| Linux | nodejs almalinux 8 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs amzn 2023 | 1:18.12.1-1.amzn2023.0.4 | [ALAS2023-2023-210](https://patchblox.com/security/data/fix/linux/alas2023-2023-210.md) | Jun 7, 2023 |
| Linux | nodejs ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs rocky 8 | 1:14.21.3-1.module+el8.7.0+1183+c2c35f0a | [RLSA-2023:1743](https://patchblox.com/security/data/fix/linux/rlsa-2023-1743.md) | Apr 26, 2023 |
| Linux | nodejs rocky 9 | 1:16.19.1-1.el9_2 | [RLSA-2023:2655](https://patchblox.com/security/data/fix/linux/rlsa-2023-2655.md) | May 25, 2023 |
| Linux | nodejs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.4 | [ALAS2023-2023-210](https://patchblox.com/security/data/fix/linux/alas2023-2023-210.md) | Jun 7, 2023 |
| Linux | nodejs-debugsource amzn 2023 | 1:18.12.1-1.amzn2023.0.4 | [ALAS2023-2023-210](https://patchblox.com/security/data/fix/linux/alas2023-2023-210.md) | Jun 7, 2023 |
| Linux | nodejs-devel RHEL 8 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-devel RHEL 9 | 1:18.14.2-2.module+el9.2.0.z+18497+a402347c | [RHSA-2023:2654](https://patchblox.com/security/data/fix/linux/rhsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-devel almalinux 8 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-devel almalinux 9 | 1:18.14.2-2.module_el9.2.0+29+de583a0b | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-devel amzn 2023 | 1:18.12.1-1.amzn2023.0.4 | [ALAS2023-2023-210](https://patchblox.com/security/data/fix/linux/alas2023-2023-210.md) | Jun 7, 2023 |
| Linux | nodejs-devel ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-devel ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-docs RHEL 8 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-docs RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-docs almalinux 8 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-docs almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-docs amzn 2023 | 1:18.12.1-1.amzn2023.0.4 | [ALAS2023-2023-210](https://patchblox.com/security/data/fix/linux/alas2023-2023-210.md) | Jun 7, 2023 |
| Linux | nodejs-docs ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-docs ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-full-i18n RHEL 8 | 1:14.21.3-1.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-full-i18n RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-full-i18n almalinux 8 | 1:14.21.3-1.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-full-i18n almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-full-i18n amzn 2023 | 1:18.12.1-1.amzn2023.0.4 | [ALAS2023-2023-210](https://patchblox.com/security/data/fix/linux/alas2023-2023-210.md) | Jun 7, 2023 |
| Linux | nodejs-full-i18n ol 8 | 1:14.21.3-1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-full-i18n ol 9 | 1:18.14.2-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-libs RHEL 9 | 1:16.19.1-1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-libs almalinux 9 | 1:16.19.1-1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-libs amzn 2023 | 1:18.12.1-1.amzn2023.0.4 | [ALAS2023-2023-210](https://patchblox.com/security/data/fix/linux/alas2023-2023-210.md) | Jun 7, 2023 |
| Linux | nodejs-libs ol 9 | 1:16.19.1-1.el9_2 | [ELSA-2023-2655](https://patchblox.com/security/data/fix/linux/elsa-2023-2655.md) | May 17, 2023 |
| Linux | nodejs-libs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.4 | [ALAS2023-2023-210](https://patchblox.com/security/data/fix/linux/alas2023-2023-210.md) | Jun 7, 2023 |
| Linux | nodejs-nodemon RHEL 8 | 0:2.0.20-3.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-nodemon RHEL 9 | 0:2.0.20-3.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | nodejs-nodemon almalinux 8 | 2.0.20-3.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-nodemon almalinux 9 | 2.0.20-2.module_el9.2.0+29+de583a0b | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-nodemon ol 8 | 0:2.0.20-3.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-nodemon ol 9 | 0:2.0.20-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-nodemon rocky 8 | 0:2.0.20-3.module+el8.7.0+1178+d52dba78 | [RLSA-2023:1743](https://patchblox.com/security/data/fix/linux/rlsa-2023-1743.md) | Apr 26, 2023 |
| Linux | nodejs-nodemon rocky 9 | 0:2.0.20-3.el9_2 | [RLSA-2023:2655](https://patchblox.com/security/data/fix/linux/rlsa-2023-2655.md) | May 25, 2023 |
| Linux | nodejs-packaging RHEL 8 | 0:23-3.module+el8.3.0+6519+9f98ed83 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-packaging RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:2654](https://patchblox.com/security/data/fix/linux/rhsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging almalinux 8 | 23-3.module_el8.4.0+2522+3bd42762 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-packaging almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging ol 8 | 0:23-3.module+el8.3.0+7818+6cd30d85 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | nodejs-packaging ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | nodejs-packaging rocky 8 | 0:23-3.module+el8.7.0+1071+4bdda2a8 | [RLSA-2023:1743](https://patchblox.com/security/data/fix/linux/rlsa-2023-1743.md) | Apr 26, 2023 |
| Linux | nodejs-packaging rocky 9 | 0:2021.06-4.module+el9.7.0+40025+0e0cf6b2 | [RLSA-2023:2654](https://patchblox.com/security/data/fix/linux/rlsa-2023-2654.md) | Dec 3, 2025 |
| Linux | nodejs-packaging-bundler RHEL 8 | 0:2021.06-4.module+el8.7.0+15582+19c314fa | [RHSA-2023:1583](https://patchblox.com/security/data/fix/linux/rhsa-2023-1583.md) | Apr 4, 2023 |
| Linux | nodejs-packaging-bundler RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:2654](https://patchblox.com/security/data/fix/linux/rhsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging-bundler almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | [ALSA-2023:1583](https://patchblox.com/security/data/fix/linux/alsa-2023-1583.md) | Apr 4, 2023 |
| Linux | nodejs-packaging-bundler almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:2654](https://patchblox.com/security/data/fix/linux/alsa-2023-2654.md) | May 9, 2023 |
| Linux | nodejs-packaging-bundler ol 8 | 0:2021.06-4.module+el8.7.0+20766+0a247725 | [ELSA-2023-1583](https://patchblox.com/security/data/fix/linux/elsa-2023-1583.md) | Apr 5, 2023 |
| Linux | nodejs-packaging-bundler ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | npm RHEL 8 | 1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6 | [RHSA-2023:1743](https://patchblox.com/security/data/fix/linux/rhsa-2023-1743.md) | Apr 12, 2023 |
| Linux | npm RHEL 9 | 1:8.19.3-1.16.19.1.1.el9_2 | [RHSA-2023:2655](https://patchblox.com/security/data/fix/linux/rhsa-2023-2655.md) | May 9, 2023 |
| Linux | npm almalinux 8 | 1:6.14.18-1.14.21.3.1.module_el8.7.0+3551+53700ee8 | [ALSA-2023:1743](https://patchblox.com/security/data/fix/linux/alsa-2023-1743.md) | Apr 12, 2023 |
| Linux | npm almalinux 9 | 1:8.19.3-1.16.19.1.1.el9_2 | [ALSA-2023:2655](https://patchblox.com/security/data/fix/linux/alsa-2023-2655.md) | May 9, 2023 |
| Linux | npm amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.4 | [ALAS2023-2023-210](https://patchblox.com/security/data/fix/linux/alas2023-2023-210.md) | Jun 7, 2023 |
| Linux | npm ol 8 | 1:6.14.18-1.14.21.3.1.module+el8.7.0+21031+52889874 | [ELSA-2023-1743](https://patchblox.com/security/data/fix/linux/elsa-2023-1743.md) | Apr 12, 2023 |
| Linux | npm ol 9 | 1:9.5.0-1.18.14.2.2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-2654](https://patchblox.com/security/data/fix/linux/elsa-2023-2654.md) | May 17, 2023 |
| Linux | v8-devel amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.4 | [ALAS2023-2023-210](https://patchblox.com/security/data/fix/linux/alas2023-2023-210.md) | Jun 7, 2023 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.