# CVE-2023-30581: Node.js 16 and 2 others: Missing Authorization

CVE-2023-30581 is fixed in 16 products on 2 platforms, first by Node.js 16 16.20.1, released June 20, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-30581
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0105
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 5, 2023
- Weakness: CWE-862: Missing Authorization
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-30581

## Description

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.  Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 16 | 16.20.1 | [Node.js 16 16.20.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.16-16.20.1.md) | Jun 20, 2023 |
| Windows apps | Node.js 18 | 18.16.1 | [Node.js 18 18.16.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.18-18.16.1.md) | Jun 20, 2023 |
| Windows apps | Node.js 20 | 20.3.1 | [Node.js 20 20.3.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.20-20.3.1.md) | Jun 20, 2023 |
| Linux | nodejs Debian 12.15 (bookworm) | 18.19.0+dfsg-6~deb12u1 | [DEBIAN-CVE-2023-30581](https://patchblox.com/security/data/fix/linux/debian-cve-2023-30581.md) | Nov 23, 2023 |
| Linux | nodejs Debian 13.5 (trixie) | 18.13.0+dfsg1-1.1 | [DEBIAN-CVE-2023-30581](https://patchblox.com/security/data/fix/linux/debian-cve-2023-30581.md) | Nov 23, 2023 |
| Linux | nodejs Debian 14 | 18.13.0+dfsg1-1.1 | [DEBIAN-CVE-2023-30581](https://patchblox.com/security/data/fix/linux/debian-cve-2023-30581.md) | Nov 23, 2023 |
| Linux | nodejs RHEL 8 | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 | [RHSA-2023:4537](https://patchblox.com/security/data/fix/linux/rhsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs RHEL 9 | 1:16.20.1-1.el9_2 | [RHSA-2023:4331](https://patchblox.com/security/data/fix/linux/rhsa-2023-4331.md) | Jul 31, 2023 |
| Linux | nodejs almalinux 8 | 1:16.20.1-1.module_el8.8.0+3594+e74fe53f | [ALSA-2023:4537](https://patchblox.com/security/data/fix/linux/alsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs almalinux 9 | 1:16.20.1-1.el9_2 | [ALSA-2023:4331](https://patchblox.com/security/data/fix/linux/alsa-2023-4331.md) | Jul 31, 2023 |
| Linux | nodejs amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | [ALAS2023-2023-237](https://patchblox.com/security/data/fix/linux/alas2023-2023-237.md) | Jul 5, 2023 |
| Linux | nodejs ol 8 | 1:16.20.1-1.module+el8.8.0+21143+178952bb | [ELSA-2023-4537](https://patchblox.com/security/data/fix/linux/elsa-2023-4537.md) | Aug 10, 2023 |
| Linux | nodejs ol 9 | 1:18.16.1-1.module+el9.2.0+21133+486db26c | [ELSA-2023-4330](https://patchblox.com/security/data/fix/linux/elsa-2023-4330.md) | Aug 2, 2023 |
| Linux | nodejs rocky 8 | 1:18.16.1-1.module+el8.8.0+1413+a47876c7 | [RLSA-2023:4536](https://patchblox.com/security/data/fix/linux/rlsa-2023-4536.md) | Oct 6, 2023 |
| Linux | nodejs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | [ALAS2023-2023-237](https://patchblox.com/security/data/fix/linux/alas2023-2023-237.md) | Jul 5, 2023 |
| Linux | nodejs-debugsource amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | [ALAS2023-2023-237](https://patchblox.com/security/data/fix/linux/alas2023-2023-237.md) | Jul 5, 2023 |
| Linux | nodejs-devel RHEL 8 | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 | [RHSA-2023:4537](https://patchblox.com/security/data/fix/linux/rhsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs-devel RHEL 9 | 1:18.16.1-1.module+el9.2.0.z+19424+78951f07 | [RHSA-2023:4330](https://patchblox.com/security/data/fix/linux/rhsa-2023-4330.md) | Jul 31, 2023 |
| Linux | nodejs-devel almalinux 8 | 1:16.20.1-1.module_el8.8.0+3594+e74fe53f | [ALSA-2023:4537](https://patchblox.com/security/data/fix/linux/alsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs-devel almalinux 9 | 1:18.16.1-1.module_el9.2.0+31+cbae0c8e | [ALSA-2023:4330](https://patchblox.com/security/data/fix/linux/alsa-2023-4330.md) | Jul 31, 2023 |
| Linux | nodejs-devel amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | [ALAS2023-2023-237](https://patchblox.com/security/data/fix/linux/alas2023-2023-237.md) | Jul 5, 2023 |
| Linux | nodejs-devel ol 8 | 1:16.20.1-1.module+el8.8.0+21143+178952bb | [ELSA-2023-4537](https://patchblox.com/security/data/fix/linux/elsa-2023-4537.md) | Aug 10, 2023 |
| Linux | nodejs-devel ol 9 | 1:18.16.1-1.module+el9.2.0+21133+486db26c | [ELSA-2023-4330](https://patchblox.com/security/data/fix/linux/elsa-2023-4330.md) | Aug 2, 2023 |
| Linux | nodejs-docs RHEL 8 | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 | [RHSA-2023:4537](https://patchblox.com/security/data/fix/linux/rhsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs-docs RHEL 9 | 1:16.20.1-1.el9_2 | [RHSA-2023:4331](https://patchblox.com/security/data/fix/linux/rhsa-2023-4331.md) | Jul 31, 2023 |
| Linux | nodejs-docs almalinux 8 | 1:16.20.1-1.module_el8.8.0+3594+e74fe53f | [ALSA-2023:4537](https://patchblox.com/security/data/fix/linux/alsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs-docs almalinux 9 | 1:16.20.1-1.el9_2 | [ALSA-2023:4331](https://patchblox.com/security/data/fix/linux/alsa-2023-4331.md) | Jul 31, 2023 |
| Linux | nodejs-docs amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | [ALAS2023-2023-237](https://patchblox.com/security/data/fix/linux/alas2023-2023-237.md) | Jul 5, 2023 |
| Linux | nodejs-docs ol 8 | 1:16.20.1-1.module+el8.8.0+21143+178952bb | [ELSA-2023-4537](https://patchblox.com/security/data/fix/linux/elsa-2023-4537.md) | Aug 10, 2023 |
| Linux | nodejs-docs ol 9 | 1:18.16.1-1.module+el9.2.0+21133+486db26c | [ELSA-2023-4330](https://patchblox.com/security/data/fix/linux/elsa-2023-4330.md) | Aug 2, 2023 |
| Linux | nodejs-full-i18n RHEL 8 | 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5 | [RHSA-2023:4537](https://patchblox.com/security/data/fix/linux/rhsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs-full-i18n RHEL 9 | 1:16.20.1-1.el9_2 | [RHSA-2023:4331](https://patchblox.com/security/data/fix/linux/rhsa-2023-4331.md) | Jul 31, 2023 |
| Linux | nodejs-full-i18n almalinux 8 | 1:16.20.1-1.module_el8.8.0+3594+e74fe53f | [ALSA-2023:4537](https://patchblox.com/security/data/fix/linux/alsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs-full-i18n almalinux 9 | 1:16.20.1-1.el9_2 | [ALSA-2023:4331](https://patchblox.com/security/data/fix/linux/alsa-2023-4331.md) | Jul 31, 2023 |
| Linux | nodejs-full-i18n amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | [ALAS2023-2023-237](https://patchblox.com/security/data/fix/linux/alas2023-2023-237.md) | Jul 5, 2023 |
| Linux | nodejs-full-i18n ol 8 | 1:16.20.1-1.module+el8.8.0+21143+178952bb | [ELSA-2023-4537](https://patchblox.com/security/data/fix/linux/elsa-2023-4537.md) | Aug 10, 2023 |
| Linux | nodejs-full-i18n ol 9 | 1:18.16.1-1.module+el9.2.0+21133+486db26c | [ELSA-2023-4330](https://patchblox.com/security/data/fix/linux/elsa-2023-4330.md) | Aug 2, 2023 |
| Linux | nodejs-libs RHEL 9 | 1:16.20.1-1.el9_2 | [RHSA-2023:4331](https://patchblox.com/security/data/fix/linux/rhsa-2023-4331.md) | Jul 31, 2023 |
| Linux | nodejs-libs almalinux 9 | 1:16.20.1-1.el9_2 | [ALSA-2023:4331](https://patchblox.com/security/data/fix/linux/alsa-2023-4331.md) | Jul 31, 2023 |
| Linux | nodejs-libs amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | [ALAS2023-2023-237](https://patchblox.com/security/data/fix/linux/alas2023-2023-237.md) | Jul 5, 2023 |
| Linux | nodejs-libs ol 9 | 1:16.20.1-1.el9_2 | [ELSA-2023-4331](https://patchblox.com/security/data/fix/linux/elsa-2023-4331.md) | Aug 2, 2023 |
| Linux | nodejs-libs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.7 | [ALAS2023-2023-237](https://patchblox.com/security/data/fix/linux/alas2023-2023-237.md) | Jul 5, 2023 |
| Linux | nodejs-nodemon RHEL 8 | 0:2.0.20-3.module+el8.8.0+19038+6f60344f | [RHSA-2023:4537](https://patchblox.com/security/data/fix/linux/rhsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs-nodemon RHEL 9 | 0:2.0.20-2.module+el9.2.0.z+18497+a402347c | [RHSA-2023:4330](https://patchblox.com/security/data/fix/linux/rhsa-2023-4330.md) | Jul 31, 2023 |
| Linux | nodejs-nodemon almalinux 8 | 2.0.20-3.module_el8.8.0+3586+d4fc0b72 | [ALSA-2023:4537](https://patchblox.com/security/data/fix/linux/alsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs-nodemon almalinux 9 | 2.0.20-2.module_el9.2.0+29+de583a0b | [ALSA-2023:4330](https://patchblox.com/security/data/fix/linux/alsa-2023-4330.md) | Jul 31, 2023 |
| Linux | nodejs-nodemon ol 8 | 0:2.0.20-3.module+el8.8.0+21143+178952bb | [ELSA-2023-4537](https://patchblox.com/security/data/fix/linux/elsa-2023-4537.md) | Aug 10, 2023 |
| Linux | nodejs-nodemon ol 9 | 0:2.0.20-2.module+el9.2.0+21038+115df6a2 | [ELSA-2023-4330](https://patchblox.com/security/data/fix/linux/elsa-2023-4330.md) | Aug 2, 2023 |
| Linux | nodejs-nodemon rocky 8 | 0:2.0.20-2.module+el8.7.0+1177+510ae886 | [RLSA-2023:4536](https://patchblox.com/security/data/fix/linux/rlsa-2023-4536.md) | Oct 6, 2023 |
| Linux | nodejs-packaging RHEL 8 | 0:25-1.module+el8.5.0+10992+fac5fe06 | [RHSA-2023:4537](https://patchblox.com/security/data/fix/linux/rhsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs-packaging RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:4330](https://patchblox.com/security/data/fix/linux/rhsa-2023-4330.md) | Jul 31, 2023 |
| Linux | nodejs-packaging almalinux 8 | 25-1.module_el8.5.0+2605+45d748af | [ALSA-2023:4537](https://patchblox.com/security/data/fix/linux/alsa-2023-4537.md) | Aug 8, 2023 |
| Linux | nodejs-packaging almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:4330](https://patchblox.com/security/data/fix/linux/alsa-2023-4330.md) | Jul 31, 2023 |
| Linux | nodejs-packaging ol 8 | 0:25-1.module+el8.5.0+20388+4b61e68d | [ELSA-2023-4537](https://patchblox.com/security/data/fix/linux/elsa-2023-4537.md) | Aug 10, 2023 |
| Linux | nodejs-packaging ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-4330](https://patchblox.com/security/data/fix/linux/elsa-2023-4330.md) | Aug 2, 2023 |
| Linux | nodejs-packaging rocky 8 | 0:2021.06-4.module+el8.7.0+1072+5b168780 | [RLSA-2023:4536](https://patchblox.com/security/data/fix/linux/rlsa-2023-4536.md) | Oct 6, 2023 |
| Linux | nodejs-packaging rocky 9 | 0:2021.06-4.module+el9.7.0+40022+9ecc286c | [RLSA-2023:4330](https://patchblox.com/security/data/fix/linux/rlsa-2023-4330.md) | Nov 8, 2026 |
| Linux | nodejs-packaging-bundler RHEL 8 | 0:2021.06-4.module+el8.7.0+15582+19c314fa | [RHSA-2023:4536](https://patchblox.com/security/data/fix/linux/rhsa-2023-4536.md) | Aug 8, 2023 |
| Linux | nodejs-packaging-bundler RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:4330](https://patchblox.com/security/data/fix/linux/rhsa-2023-4330.md) | Jul 31, 2023 |
| Linux | nodejs-packaging-bundler almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | [ALSA-2023:4536](https://patchblox.com/security/data/fix/linux/alsa-2023-4536.md) | Aug 8, 2023 |
| Linux | nodejs-packaging-bundler almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:4330](https://patchblox.com/security/data/fix/linux/alsa-2023-4330.md) | Jul 31, 2023 |
| Linux | nodejs-packaging-bundler ol 8 | 0:2021.06-4.module+el8.7.0+20766+0a247725 | [ELSA-2023-4536](https://patchblox.com/security/data/fix/linux/elsa-2023-4536.md) | Aug 10, 2023 |
| Linux | nodejs-packaging-bundler ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-4330](https://patchblox.com/security/data/fix/linux/elsa-2023-4330.md) | Aug 2, 2023 |
| Linux | npm RHEL 8 | 1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5 | [RHSA-2023:4537](https://patchblox.com/security/data/fix/linux/rhsa-2023-4537.md) | Aug 8, 2023 |
| Linux | npm RHEL 9 | 1:8.19.4-1.16.20.1.1.el9_2 | [RHSA-2023:4331](https://patchblox.com/security/data/fix/linux/rhsa-2023-4331.md) | Jul 31, 2023 |
| Linux | npm almalinux 8 | 1:8.19.4-1.16.20.1.1.module_el8.8.0+3594+e74fe53f | [ALSA-2023:4537](https://patchblox.com/security/data/fix/linux/alsa-2023-4537.md) | Aug 8, 2023 |
| Linux | npm almalinux 9 | 1:8.19.4-1.16.20.1.1.el9_2 | [ALSA-2023:4331](https://patchblox.com/security/data/fix/linux/alsa-2023-4331.md) | Jul 31, 2023 |
| Linux | npm amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.7 | [ALAS2023-2023-237](https://patchblox.com/security/data/fix/linux/alas2023-2023-237.md) | Jul 5, 2023 |
| Linux | npm ol 8 | 1:8.19.4-1.16.20.1.1.module+el8.8.0+21143+178952bb | [ELSA-2023-4537](https://patchblox.com/security/data/fix/linux/elsa-2023-4537.md) | Aug 10, 2023 |
| Linux | npm ol 9 | 1:9.5.1-1.18.16.1.1.module+el9.2.0+21133+486db26c | [ELSA-2023-4330](https://patchblox.com/security/data/fix/linux/elsa-2023-4330.md) | Aug 2, 2023 |
| Linux | v8-devel amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.7 | [ALAS2023-2023-237](https://patchblox.com/security/data/fix/linux/alas2023-2023-237.md) | Jul 5, 2023 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.