# CVE-2023-38552: Node.js 18 and 1 other: When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application…

CVE-2023-38552 is fixed in 16 products on 2 platforms, first by Node.js 18 18.18.2, released October 13, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-38552
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0124
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 18, 2023
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-38552

## Description

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Node.js 18 | 18.18.2 | [Node.js 18 18.18.2](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.18-18.18.2.md) | Oct 13, 2023 |
| Windows apps | Node.js 20 | 20.9.0 | [Node.js 20 20.9.0](https://patchblox.com/security/data/fix/windows-app/openjs.nodejs.20-20.9.0.md) | Oct 24, 2023 |
| Linux | nodejs Debian 12.15 (bookworm) | 18.19.0+dfsg-6~deb12u1 | [DEBIAN-CVE-2023-38552](https://patchblox.com/security/data/fix/linux/debian-cve-2023-38552.md) | Oct 18, 2023 |
| Linux | nodejs Debian 13.5 (trixie) | 18.13.0+dfsg1-1.1 | [DEBIAN-CVE-2023-38552](https://patchblox.com/security/data/fix/linux/debian-cve-2023-38552.md) | Oct 18, 2023 |
| Linux | nodejs Debian 14 | 18.13.0+dfsg1-1.1 | [DEBIAN-CVE-2023-38552](https://patchblox.com/security/data/fix/linux/debian-cve-2023-38552.md) | Oct 18, 2023 |
| Linux | nodejs RHEL 8 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | [RHSA-2023:7205](https://patchblox.com/security/data/fix/linux/rhsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs RHEL 9 | 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 | [RHSA-2023:5849](https://patchblox.com/security/data/fix/linux/rhsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs almalinux 8 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | [ALSA-2023:7205](https://patchblox.com/security/data/fix/linux/alsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs almalinux 9 | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | [ALSA-2023:5849](https://patchblox.com/security/data/fix/linux/alsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs amzn 2023 | 1:18.18.2-1.amzn2023.0.1 | [ALAS2023-2023-412](https://patchblox.com/security/data/fix/linux/alas2023-2023-412.md) | Oct 30, 2023 |
| Linux | nodejs ol 8 | 1:18.18.2-1.module+el8.8.0+21193+eb5c830b | [ELSA-2023-5869](https://patchblox.com/security/data/fix/linux/elsa-2023-5869.md) | Oct 23, 2023 |
| Linux | nodejs ol 9 | 1:18.18.2-2.module+el9.2.0+21194+c0bbf6cf | [ELSA-2023-5849](https://patchblox.com/security/data/fix/linux/elsa-2023-5849.md) | Oct 20, 2023 |
| Linux | nodejs-debuginfo amzn 2023 | 1:18.18.2-1.amzn2023.0.1 | [ALAS2023-2023-412](https://patchblox.com/security/data/fix/linux/alas2023-2023-412.md) | Oct 30, 2023 |
| Linux | nodejs-debugsource amzn 2023 | 1:18.18.2-1.amzn2023.0.1 | [ALAS2023-2023-412](https://patchblox.com/security/data/fix/linux/alas2023-2023-412.md) | Oct 30, 2023 |
| Linux | nodejs-devel RHEL 8 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | [RHSA-2023:7205](https://patchblox.com/security/data/fix/linux/rhsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-devel RHEL 9 | 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 | [RHSA-2023:5849](https://patchblox.com/security/data/fix/linux/rhsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-devel almalinux 8 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | [ALSA-2023:7205](https://patchblox.com/security/data/fix/linux/alsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-devel almalinux 9 | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | [ALSA-2023:5849](https://patchblox.com/security/data/fix/linux/alsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-devel amzn 2023 | 1:18.18.2-1.amzn2023.0.1 | [ALAS2023-2023-412](https://patchblox.com/security/data/fix/linux/alas2023-2023-412.md) | Oct 30, 2023 |
| Linux | nodejs-devel ol 8 | 1:18.18.2-1.module+el8.8.0+21193+eb5c830b | [ELSA-2023-5869](https://patchblox.com/security/data/fix/linux/elsa-2023-5869.md) | Oct 23, 2023 |
| Linux | nodejs-devel ol 9 | 1:18.18.2-2.module+el9.2.0+21194+c0bbf6cf | [ELSA-2023-5849](https://patchblox.com/security/data/fix/linux/elsa-2023-5849.md) | Oct 20, 2023 |
| Linux | nodejs-docs RHEL 8 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | [RHSA-2023:7205](https://patchblox.com/security/data/fix/linux/rhsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-docs RHEL 9 | 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 | [RHSA-2023:5849](https://patchblox.com/security/data/fix/linux/rhsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-docs almalinux 8 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | [ALSA-2023:7205](https://patchblox.com/security/data/fix/linux/alsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-docs almalinux 9 | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | [ALSA-2023:5849](https://patchblox.com/security/data/fix/linux/alsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-docs amzn 2023 | 1:18.18.2-1.amzn2023.0.1 | [ALAS2023-2023-412](https://patchblox.com/security/data/fix/linux/alas2023-2023-412.md) | Oct 30, 2023 |
| Linux | nodejs-docs ol 8 | 1:18.18.2-1.module+el8.8.0+21193+eb5c830b | [ELSA-2023-5869](https://patchblox.com/security/data/fix/linux/elsa-2023-5869.md) | Oct 23, 2023 |
| Linux | nodejs-docs ol 9 | 1:18.18.2-2.module+el9.2.0+21194+c0bbf6cf | [ELSA-2023-5849](https://patchblox.com/security/data/fix/linux/elsa-2023-5849.md) | Oct 20, 2023 |
| Linux | nodejs-full-i18n RHEL 8 | 1:20.8.1-1.module+el8.9.0+20473+c4e3d824 | [RHSA-2023:7205](https://patchblox.com/security/data/fix/linux/rhsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-full-i18n RHEL 9 | 1:18.18.2-2.module+el9.2.0.z+20408+7cb5fda5 | [RHSA-2023:5849](https://patchblox.com/security/data/fix/linux/rhsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-full-i18n almalinux 8 | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 | [ALSA-2023:7205](https://patchblox.com/security/data/fix/linux/alsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-full-i18n almalinux 9 | 1:18.18.2-2.module_el9.2.0+43+3ebc9e20 | [ALSA-2023:5849](https://patchblox.com/security/data/fix/linux/alsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-full-i18n amzn 2023 | 1:18.18.2-1.amzn2023.0.1 | [ALAS2023-2023-412](https://patchblox.com/security/data/fix/linux/alas2023-2023-412.md) | Oct 30, 2023 |
| Linux | nodejs-full-i18n ol 8 | 1:18.18.2-1.module+el8.8.0+21193+eb5c830b | [ELSA-2023-5869](https://patchblox.com/security/data/fix/linux/elsa-2023-5869.md) | Oct 23, 2023 |
| Linux | nodejs-full-i18n ol 9 | 1:18.18.2-2.module+el9.2.0+21194+c0bbf6cf | [ELSA-2023-5849](https://patchblox.com/security/data/fix/linux/elsa-2023-5849.md) | Oct 20, 2023 |
| Linux | nodejs-libs amzn 2023 | 1:18.18.2-1.amzn2023.0.1 | [ALAS2023-2023-412](https://patchblox.com/security/data/fix/linux/alas2023-2023-412.md) | Oct 30, 2023 |
| Linux | nodejs-libs-debuginfo amzn 2023 | 1:18.18.2-1.amzn2023.0.1 | [ALAS2023-2023-412](https://patchblox.com/security/data/fix/linux/alas2023-2023-412.md) | Oct 30, 2023 |
| Linux | nodejs-nodemon RHEL 8 | 0:3.0.1-1.module+el8.9.0+20473+c4e3d824 | [RHSA-2023:7205](https://patchblox.com/security/data/fix/linux/rhsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-nodemon RHEL 9 | 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0 | [RHSA-2023:5849](https://patchblox.com/security/data/fix/linux/rhsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-nodemon almalinux 8 | 3.0.1-1.module_el8.9.0+3675+0258a6d9 | [ALSA-2023:7205](https://patchblox.com/security/data/fix/linux/alsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-nodemon almalinux 9 | 3.0.1-1.module_el9.2.0+36+853e48f5 | [ALSA-2023:5849](https://patchblox.com/security/data/fix/linux/alsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-nodemon ol 8 | 0:3.0.1-1.module+el8.8.0+21170+2efec6d4 | [ELSA-2023-5869](https://patchblox.com/security/data/fix/linux/elsa-2023-5869.md) | Oct 23, 2023 |
| Linux | nodejs-nodemon ol 9 | 0:3.0.1-1.module+el9.2.0+21169+1d24b6cc | [ELSA-2023-5849](https://patchblox.com/security/data/fix/linux/elsa-2023-5849.md) | Oct 20, 2023 |
| Linux | nodejs-nodemon rocky 8 | 0:3.0.1-1.module+el8.10.0+1824+532140ee | [RLSA-2023:5869](https://patchblox.com/security/data/fix/linux/rlsa-2023-5869.md) | Dec 4, 2025 |
| Linux | nodejs-nodemon rocky 9 | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 | [RLSA-2023:5849](https://patchblox.com/security/data/fix/linux/rlsa-2023-5849.md) | Dec 4, 2025 |
| Linux | nodejs-npm amzn 2023 | 1:9.8.1-1.18.18.2.1.amzn2023.0.1 | [ALAS2023-2023-412](https://patchblox.com/security/data/fix/linux/alas2023-2023-412.md) | Oct 30, 2023 |
| Linux | nodejs-packaging RHEL 8 | 0:2021.06-4.module+el8.9.0+19519+e25b965a | [RHSA-2023:7205](https://patchblox.com/security/data/fix/linux/rhsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-packaging RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:5849](https://patchblox.com/security/data/fix/linux/rhsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-packaging almalinux 8 | 2021.06-4.module_el8.9.0+3684+11b9e959 | [ALSA-2023:7205](https://patchblox.com/security/data/fix/linux/alsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-packaging almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:5849](https://patchblox.com/security/data/fix/linux/alsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-packaging ol 8 | 0:2021.06-4.module+el8.7.0+20766+0a247725 | [ELSA-2023-5869](https://patchblox.com/security/data/fix/linux/elsa-2023-5869.md) | Oct 23, 2023 |
| Linux | nodejs-packaging ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-5849](https://patchblox.com/security/data/fix/linux/elsa-2023-5849.md) | Oct 20, 2023 |
| Linux | nodejs-packaging rocky 8 | 0:2021.06-4.module+el8.10.0+1989+e60144d9 | [RLSA-2023:5869](https://patchblox.com/security/data/fix/linux/rlsa-2023-5869.md) | Dec 4, 2025 |
| Linux | nodejs-packaging rocky 9 | 0:2021.06-4.module+el9.7.0+40022+9ecc286c | [RLSA-2023:5849](https://patchblox.com/security/data/fix/linux/rlsa-2023-5849.md) | Dec 4, 2025 |
| Linux | nodejs-packaging-bundler RHEL 8 | 0:2021.06-4.module+el8.9.0+19519+e25b965a | [RHSA-2023:7205](https://patchblox.com/security/data/fix/linux/rhsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-packaging-bundler RHEL 9 | 0:2021.06-4.module+el9.1.0+15718+e52ec601 | [RHSA-2023:5849](https://patchblox.com/security/data/fix/linux/rhsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-packaging-bundler almalinux 8 | 2021.06-4.module_el8.9.0+3684+11b9e959 | [ALSA-2023:7205](https://patchblox.com/security/data/fix/linux/alsa-2023-7205.md) | Nov 14, 2023 |
| Linux | nodejs-packaging-bundler almalinux 9 | 2021.06-4.module_el9.1.0+13+d9a595ea | [ALSA-2023:5849](https://patchblox.com/security/data/fix/linux/alsa-2023-5849.md) | Oct 18, 2023 |
| Linux | nodejs-packaging-bundler ol 8 | 0:2021.06-4.module+el8.7.0+20766+0a247725 | [ELSA-2023-5869](https://patchblox.com/security/data/fix/linux/elsa-2023-5869.md) | Oct 23, 2023 |
| Linux | nodejs-packaging-bundler ol 9 | 0:2021.06-4.module+el9.1.0+20762+f52d7401 | [ELSA-2023-5849](https://patchblox.com/security/data/fix/linux/elsa-2023-5849.md) | Oct 20, 2023 |
| Linux | npm RHEL 8 | 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824 | [RHSA-2023:7205](https://patchblox.com/security/data/fix/linux/rhsa-2023-7205.md) | Nov 14, 2023 |
| Linux | npm RHEL 9 | 1:9.8.1-1.18.18.2.2.module+el9.2.0.z+20408+7cb5fda5 | [RHSA-2023:5849](https://patchblox.com/security/data/fix/linux/rhsa-2023-5849.md) | Oct 18, 2023 |
| Linux | npm almalinux 8 | 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 | [ALSA-2023:7205](https://patchblox.com/security/data/fix/linux/alsa-2023-7205.md) | Nov 14, 2023 |
| Linux | npm almalinux 9 | 1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20 | [ALSA-2023:5849](https://patchblox.com/security/data/fix/linux/alsa-2023-5849.md) | Oct 18, 2023 |
| Linux | npm ol 8 | 1:9.8.1-1.18.18.2.1.module+el8.8.0+21193+eb5c830b | [ELSA-2023-5869](https://patchblox.com/security/data/fix/linux/elsa-2023-5869.md) | Oct 23, 2023 |
| Linux | npm ol 9 | 1:9.8.1-1.18.18.2.2.module+el9.2.0+21194+c0bbf6cf | [ELSA-2023-5849](https://patchblox.com/security/data/fix/linux/elsa-2023-5849.md) | Oct 20, 2023 |
| Linux | v8-10.2-devel amzn 2023 | 3:10.2.154.26-1.18.18.2.1.amzn2023.0.1 | [ALAS2023-2023-412](https://patchblox.com/security/data/fix/linux/alas2023-2023-412.md) | Oct 30, 2023 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.