CVE-2023-23919
Full vulnerability record from the local CVENow database.
Description
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2023-02-23 20:15:13.977000
Last modified
2026-10-24 13:10:00.147000
View original CVE JSON
{
"id": "CVE-2023-23919",
"sourceIdentifier": "[email protected]",
"published": "2023-02-23T20:15:13.977",
"lastModified": "2026-10-24T13:10:00.147",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service."
},
{
"lang": "es",
"value": "Una vulnerabilidad criptográfica existe en Node.js anterior a 19.2.0, anterior a 18.14.1, anterior a 16.19.1, anterior a 14.21.3 que en algunos casos no limpia la pila de errores de OpenSSL después de operaciones que pueden establecerla. Esto puede llevar a errores de falso positivo durante operaciones criptográficas subsiguientes que se ejecutan en el mismo hilo. Esto a su vez podría usarse para causar una denegación de servicio."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "NodeJS",
"product": "Node",
"defaultStatus": "unaffected",
"versions": [
{
"version": "4.0",
"lessThan": "4.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "5.0",
"lessThan": "5.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.0",
"lessThan": "6.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.0",
"lessThan": "7.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.0",
"lessThan": "8.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.0",
"lessThan": "9.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.0",
"lessThan": "10.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.0",
"lessThan": "11.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.0",
"lessThan": "12.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "13.0",
"lessThan": "13.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "14.0",
"lessThan": "14.21.3",
"versionType": "semver",
"status": "affected"
},
{
"version": "15.0",
"lessThan": "15.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "16.0",
"lessThan": "16.19.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "17.0",
"lessThan": "17.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "18.0",
"lessThan": "18.14.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "19.0",
"lessThan": "19.2.0",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-03-12T14:26:46.934403Z",
"id": "CVE-2023-23919",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-310"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"versionStartIncluding": "14.0.0",
"versionEndIncluding": "14.14.0",
"matchCriteriaId": "428DCD7B-6F66-4F18-B780-5BD80143D482"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
"versionStartIncluding": "14.0.0",
"versionEndExcluding": "14.21.3",
"matchCriteriaId": "DA48F3CE-68BC-43F1-9428-A9F928420081"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"versionStartIncluding": "16.0.0",
"versionEndIncluding": "16.12.0",
"matchCriteriaId": "1D1D0CEC-62E5-4368-B8F2-1DA5DD0B88FA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
"versionStartIncluding": "16.0.0",
"versionEndExcluding": "16.19.1",
"matchCriteriaId": "6E9FAEC6-2D3A-4CBE-859F-11BCECC4F724"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"versionStartIncluding": "18.0.0",
"versionEndIncluding": "18.11.0",
"matchCriteriaId": "33DB62F6-9D8D-42F8-A75E-82DA091C02BC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
"versionStartIncluding": "18.0.0",
"versionEndExcluding": "18.14.1",
"matchCriteriaId": "80500AD0-17C2-4698-AE03-1C6782FD38B0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"versionStartIncluding": "19.0.0",
"versionEndExcluding": "19.2.0",
"matchCriteriaId": "57BCF42B-D5BC-433A-A4BA-E3014E275FA7"
}
]
}
]
}
],
"references": [
{
"url": "https://hackerone.com/reports/1808596",
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/",
"source": "[email protected]",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://security.netapp.com/advisory/ntap-20230316-0008/",
"source": "[email protected]"
},
{
"url": "https://hackerone.com/reports/1808596",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://security.netapp.com/advisory/ntap-20230316-0008/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}