# CVE-2023-32002: HackerOne: CVE-2023-32002 Node.js `Module._load()` policy Remote Code Execution Vulnerability

CVE-2023-32002 is fixed in 17 products on 2 platforms, first by Node.js 16 16.20.2, released August 8, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-32002
- Priority: High
- CVSS: 9.8 (Important)
- EPSS: 0.0161
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Vendor exploitability assessment: Exploitation Unlikely
- Published: Aug 17, 2023
- Weakness: CWE-288: Authentication Bypass Using an Alternate Path or Channel
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32002

## Description

The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.  This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.  Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 16 | 16.20.2 | [Node.js 16 16.20.2](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.16-16.20.2.md) | Aug 8, 2023 |
| Windows apps | Node.js 18 | 18.17.1 | [Node.js 18 18.17.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.18-18.17.1.md) | Aug 8, 2023 |
| Windows apps | Node.js 20 | 20.5.1 | [Node.js 20 20.5.1](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.20-20.5.1.md) | Aug 9, 2023 |
| Linux | libnode72 Ubuntu 22.04.1 LTS (jammy) | 12.22.9~dfsg-1ubuntu3.6 | [libnode72 12.22.9~dfsg-1ubuntu3.6](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libnode72-12.22.9-dfsg-1ubuntu3.6.md) | Aug 23, 2023 |
| Linux | nodejs Debian 12.15 (bookworm) | 18.19.0+dfsg-6~deb12u1 | [DEBIAN-CVE-2023-32002](https://patchblox.com/security/data/fix/linux/debian-cve-2023-32002.md) | Aug 21, 2023 |
| Linux | nodejs Debian 13.5 (trixie) | 18.13.0+dfsg1-1.1 | [DEBIAN-CVE-2023-32002](https://patchblox.com/security/data/fix/linux/debian-cve-2023-32002.md) | Aug 21, 2023 |
| Linux | nodejs Debian 14 | 18.13.0+dfsg1-1.1 | [DEBIAN-CVE-2023-32002](https://patchblox.com/security/data/fix/linux/debian-cve-2023-32002.md) | Aug 21, 2023 |
| Linux | nodejs RHEL 8 | 1:18.17.1-1.module+el8.8.0+19757+8ca87034 | [RHSA-2023:5362](https://patchblox.com/security/data/fix/linux/rhsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs RHEL 9 | 1:16.20.2-1.el9_2 | [RHSA-2023:5532](https://patchblox.com/security/data/fix/linux/rhsa-2023-5532.md) | Oct 9, 2023 |
| Linux | nodejs Ubuntu 22.04.1 LTS (jammy) | 12.22.9~dfsg-1ubuntu3.6 | [nodejs 12.22.9~dfsg-1ubuntu3.6](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-nodejs-12.22.9-dfsg-1ubuntu3.6.md) | Aug 23, 2023 |
| Linux | nodejs almalinux 8 | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d | [ALSA-2023:5362](https://patchblox.com/security/data/fix/linux/alsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs almalinux 9 | 1:16.20.2-1.el9_2 | [ALSA-2023:5532](https://patchblox.com/security/data/fix/linux/alsa-2023-5532.md) | Oct 9, 2023 |
| Linux | nodejs amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | [ALAS2023-2023-304](https://patchblox.com/security/data/fix/linux/alas2023-2023-304.md) | Aug 17, 2023 |
| Linux | nodejs ol 8 | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 | [ELSA-2023-5362](https://patchblox.com/security/data/fix/linux/elsa-2023-5362.md) | Sep 28, 2023 |
| Linux | nodejs ol 9 | 1:16.20.2-1.el9_2 | [ELSA-2023-5532](https://patchblox.com/security/data/fix/linux/elsa-2023-5532.md) | Oct 10, 2023 |
| Linux | nodejs rocky 9 | 1:16.20.2-1.el9_2 | [RLSA-2023:5532](https://patchblox.com/security/data/fix/linux/rlsa-2023-5532.md) | Oct 14, 2023 |
| Linux | nodejs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | [ALAS2023-2023-304](https://patchblox.com/security/data/fix/linux/alas2023-2023-304.md) | Aug 17, 2023 |
| Linux | nodejs-debugsource amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | [ALAS2023-2023-304](https://patchblox.com/security/data/fix/linux/alas2023-2023-304.md) | Aug 17, 2023 |
| Linux | nodejs-devel RHEL 8 | 1:18.17.1-1.module+el8.8.0+19757+8ca87034 | [RHSA-2023:5362](https://patchblox.com/security/data/fix/linux/rhsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-devel RHEL 9 | 1:18.17.1-1.module+el9.2.0.z+19753+58118bc0 | [RHSA-2023:5363](https://patchblox.com/security/data/fix/linux/rhsa-2023-5363.md) | Sep 26, 2023 |
| Linux | nodejs-devel almalinux 8 | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d | [ALSA-2023:5362](https://patchblox.com/security/data/fix/linux/alsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-devel almalinux 9 | 1:18.17.1-1.module_el9.2.0+36+853e48f5 | [ALSA-2023:5363](https://patchblox.com/security/data/fix/linux/alsa-2023-5363.md) | Sep 26, 2023 |
| Linux | nodejs-devel amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | [ALAS2023-2023-304](https://patchblox.com/security/data/fix/linux/alas2023-2023-304.md) | Aug 17, 2023 |
| Linux | nodejs-devel ol 8 | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 | [ELSA-2023-5362](https://patchblox.com/security/data/fix/linux/elsa-2023-5362.md) | Sep 28, 2023 |
| Linux | nodejs-devel ol 9 | 1:18.17.1-1.module+el9.2.0+21169+1d24b6cc | [ELSA-2023-5363](https://patchblox.com/security/data/fix/linux/elsa-2023-5363.md) | Oct 5, 2023 |
| Linux | nodejs-docs RHEL 8 | 1:18.17.1-1.module+el8.8.0+19757+8ca87034 | [RHSA-2023:5362](https://patchblox.com/security/data/fix/linux/rhsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-docs RHEL 9 | 1:16.20.2-1.el9_2 | [RHSA-2023:5532](https://patchblox.com/security/data/fix/linux/rhsa-2023-5532.md) | Oct 9, 2023 |
| Linux | nodejs-docs almalinux 8 | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d | [ALSA-2023:5362](https://patchblox.com/security/data/fix/linux/alsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-docs almalinux 9 | 1:16.20.2-1.el9_2 | [ALSA-2023:5532](https://patchblox.com/security/data/fix/linux/alsa-2023-5532.md) | Oct 9, 2023 |
| Linux | nodejs-docs amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | [ALAS2023-2023-304](https://patchblox.com/security/data/fix/linux/alas2023-2023-304.md) | Aug 17, 2023 |
| Linux | nodejs-docs ol 8 | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 | [ELSA-2023-5362](https://patchblox.com/security/data/fix/linux/elsa-2023-5362.md) | Sep 28, 2023 |
| Linux | nodejs-docs ol 9 | 1:16.20.2-1.el9_2 | [ELSA-2023-5532](https://patchblox.com/security/data/fix/linux/elsa-2023-5532.md) | Oct 10, 2023 |
| Linux | nodejs-full-i18n RHEL 8 | 1:18.17.1-1.module+el8.8.0+19757+8ca87034 | [RHSA-2023:5362](https://patchblox.com/security/data/fix/linux/rhsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-full-i18n RHEL 9 | 1:16.20.2-1.el9_2 | [RHSA-2023:5532](https://patchblox.com/security/data/fix/linux/rhsa-2023-5532.md) | Oct 9, 2023 |
| Linux | nodejs-full-i18n almalinux 8 | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d | [ALSA-2023:5362](https://patchblox.com/security/data/fix/linux/alsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-full-i18n almalinux 9 | 1:16.20.2-1.el9_2 | [ALSA-2023:5532](https://patchblox.com/security/data/fix/linux/alsa-2023-5532.md) | Oct 9, 2023 |
| Linux | nodejs-full-i18n amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | [ALAS2023-2023-304](https://patchblox.com/security/data/fix/linux/alas2023-2023-304.md) | Aug 17, 2023 |
| Linux | nodejs-full-i18n ol 8 | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 | [ELSA-2023-5362](https://patchblox.com/security/data/fix/linux/elsa-2023-5362.md) | Sep 28, 2023 |
| Linux | nodejs-full-i18n ol 9 | 1:16.20.2-1.el9_2 | [ELSA-2023-5532](https://patchblox.com/security/data/fix/linux/elsa-2023-5532.md) | Oct 10, 2023 |
| Linux | nodejs-libs RHEL 9 | 1:16.20.2-1.el9_2 | [RHSA-2023:5532](https://patchblox.com/security/data/fix/linux/rhsa-2023-5532.md) | Oct 9, 2023 |
| Linux | nodejs-libs almalinux 9 | 1:16.20.2-1.el9_2 | [ALSA-2023:5532](https://patchblox.com/security/data/fix/linux/alsa-2023-5532.md) | Oct 9, 2023 |
| Linux | nodejs-libs amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | [ALAS2023-2023-304](https://patchblox.com/security/data/fix/linux/alas2023-2023-304.md) | Aug 17, 2023 |
| Linux | nodejs-libs ol 9 | 1:16.20.2-1.el9_2 | [ELSA-2023-5532](https://patchblox.com/security/data/fix/linux/elsa-2023-5532.md) | Oct 10, 2023 |
| Linux | nodejs-libs-debuginfo amzn 2023 | 1:18.12.1-1.amzn2023.0.10 | [ALAS2023-2023-304](https://patchblox.com/security/data/fix/linux/alas2023-2023-304.md) | Aug 17, 2023 |
| Linux | nodejs-nodemon RHEL 8 | 0:3.0.1-1.module+el8.8.0+19757+8ca87034 | [RHSA-2023:5362](https://patchblox.com/security/data/fix/linux/rhsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-nodemon RHEL 9 | 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0 | [RHSA-2023:5363](https://patchblox.com/security/data/fix/linux/rhsa-2023-5363.md) | Sep 26, 2023 |
| Linux | nodejs-nodemon almalinux 8 | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | [ALSA-2023:5362](https://patchblox.com/security/data/fix/linux/alsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-nodemon almalinux 9 | 3.0.1-1.module_el9.2.0+36+853e48f5 | [ALSA-2023:5363](https://patchblox.com/security/data/fix/linux/alsa-2023-5363.md) | Sep 26, 2023 |
| Linux | nodejs-nodemon ol 8 | 0:3.0.1-1.module+el8.8.0+21170+2efec6d4 | [ELSA-2023-5362](https://patchblox.com/security/data/fix/linux/elsa-2023-5362.md) | Sep 28, 2023 |
| Linux | nodejs-nodemon ol 9 | 0:3.0.1-1.module+el9.2.0+21169+1d24b6cc | [ELSA-2023-5363](https://patchblox.com/security/data/fix/linux/elsa-2023-5363.md) | Oct 5, 2023 |
| Linux | nodejs-nodemon rocky 8 | 0:3.0.1-1.module+el8.10.0+1667+4a788d89 | [RLSA-2023:5362](https://patchblox.com/security/data/fix/linux/rlsa-2023-5362.md) | Dec 20, 2025 |
| Linux | nodejs-nodemon rocky 9 | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | [RLSA-2023:5363](https://patchblox.com/security/data/fix/linux/rlsa-2023-5363.md) | Oct 5, 2023 |
| Linux | nodejs-packaging RHEL 8 | 0:2021.06-4.module+el8.7.0+15582+19c314fa | [RHSA-2023:5362](https://patchblox.com/security/data/fix/linux/rhsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-packaging RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:5363](https://patchblox.com/security/data/fix/linux/rhsa-2023-5363.md) | Sep 26, 2023 |
| Linux | nodejs-packaging almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | [ALSA-2023:5362](https://patchblox.com/security/data/fix/linux/alsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-packaging almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:5363](https://patchblox.com/security/data/fix/linux/alsa-2023-5363.md) | Sep 26, 2023 |
| Linux | nodejs-packaging ol 8 | 0:2021.06-4.module+el8.7.0+20766+0a247725 | [ELSA-2023-5362](https://patchblox.com/security/data/fix/linux/elsa-2023-5362.md) | Sep 28, 2023 |
| Linux | nodejs-packaging ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-5363](https://patchblox.com/security/data/fix/linux/elsa-2023-5363.md) | Oct 5, 2023 |
| Linux | nodejs-packaging rocky 8 | 0:2021.06-4.module+el8.10.0+1924+614dc87f | [RLSA-2023:5362](https://patchblox.com/security/data/fix/linux/rlsa-2023-5362.md) | Dec 20, 2025 |
| Linux | nodejs-packaging rocky 9 | 0:2021.06-4.module+el9.5.0+31770+0da7192d | [RLSA-2023:5363](https://patchblox.com/security/data/fix/linux/rlsa-2023-5363.md) | Oct 5, 2023 |
| Linux | nodejs-packaging-bundler RHEL 8 | 0:2021.06-4.module+el8.7.0+15582+19c314fa | [RHSA-2023:5362](https://patchblox.com/security/data/fix/linux/rhsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-packaging-bundler RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:5363](https://patchblox.com/security/data/fix/linux/rhsa-2023-5363.md) | Sep 26, 2023 |
| Linux | nodejs-packaging-bundler almalinux 8 | 2021.06-4.module_el8.7.0+3343+ea2b7901 | [ALSA-2023:5362](https://patchblox.com/security/data/fix/linux/alsa-2023-5362.md) | Sep 26, 2023 |
| Linux | nodejs-packaging-bundler almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:5363](https://patchblox.com/security/data/fix/linux/alsa-2023-5363.md) | Sep 26, 2023 |
| Linux | nodejs-packaging-bundler ol 8 | 0:2021.06-4.module+el8.7.0+20766+0a247725 | [ELSA-2023-5362](https://patchblox.com/security/data/fix/linux/elsa-2023-5362.md) | Sep 28, 2023 |
| Linux | nodejs-packaging-bundler ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-5363](https://patchblox.com/security/data/fix/linux/elsa-2023-5363.md) | Oct 5, 2023 |
| Linux | npm RHEL 8 | 1:9.6.7-1.18.17.1.1.module+el8.8.0+19757+8ca87034 | [RHSA-2023:5362](https://patchblox.com/security/data/fix/linux/rhsa-2023-5362.md) | Sep 26, 2023 |
| Linux | npm RHEL 9 | 1:8.19.4-1.16.20.2.1.el9_2 | [RHSA-2023:5532](https://patchblox.com/security/data/fix/linux/rhsa-2023-5532.md) | Oct 9, 2023 |
| Linux | npm almalinux 8 | 1:9.6.7-1.18.17.1.1.module_el8.8.0+3613+1ed8c91d | [ALSA-2023:5362](https://patchblox.com/security/data/fix/linux/alsa-2023-5362.md) | Sep 26, 2023 |
| Linux | npm almalinux 9 | 1:8.19.4-1.16.20.2.1.el9_2 | [ALSA-2023:5532](https://patchblox.com/security/data/fix/linux/alsa-2023-5532.md) | Oct 9, 2023 |
| Linux | npm amzn 2023 | 1:8.19.2-1.18.12.1.1.amzn2023.0.10 | [ALAS2023-2023-304](https://patchblox.com/security/data/fix/linux/alas2023-2023-304.md) | Aug 17, 2023 |
| Linux | npm ol 8 | 1:9.6.7-1.18.17.1.1.module+el8.8.0+21170+2efec6d4 | [ELSA-2023-5362](https://patchblox.com/security/data/fix/linux/elsa-2023-5362.md) | Sep 28, 2023 |
| Linux | npm ol 9 | 1:8.19.4-1.16.20.2.1.el9_2 | [ELSA-2023-5532](https://patchblox.com/security/data/fix/linux/elsa-2023-5532.md) | Oct 10, 2023 |
| Linux | v8-devel amzn 2023 | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.10 | [ALAS2023-2023-304](https://patchblox.com/security/data/fix/linux/alas2023-2023-304.md) | Aug 17, 2023 |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.