CVE-2023-30588
Full vulnerability record from the local CVENow database.
Description
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.
Severity
MEDIUM
CVSS score
5.3
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2023-11-28 20:15:07.437000
Last modified
2026-11-02 23:17:16.310000
View original CVE JSON
{
"id": "CVE-2023-30588",
"sourceIdentifier": "[email protected]",
"published": "2023-11-28T20:15:07.437",
"lastModified": "2026-11-02T23:17:16.310",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20."
},
{
"lang": "es",
"value": "Cuando se utiliza una clave pública no válida para crear x509 certificates utilizando la API crypto.X509Certificate(), se produce una terminación no esperada que la hace susceptible a ataques DoS cuando el atacante podría forzar interrupciones en el procesamiento de la aplicación, ya que el proceso finaliza al acceder a la información de clave pública de los certificados proporcionados desde el código de usuario. El contexto actual de los usuarios desaparecerá y eso provocará un escenario DoS. Esta vulnerabilidad afecta a todas las versiones activas de Node.js v16, v18 y v20."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "NodeJS",
"product": "Node",
"defaultStatus": "unaffected",
"versions": [
{
"version": "4.0",
"lessThan": "4.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "5.0",
"lessThan": "5.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "6.0",
"lessThan": "6.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "7.0",
"lessThan": "7.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.0",
"lessThan": "8.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "9.0",
"lessThan": "9.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "10.0",
"lessThan": "10.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "11.0",
"lessThan": "11.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "12.0",
"lessThan": "12.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "13.0",
"lessThan": "13.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "14.0",
"lessThan": "14.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "15.0",
"lessThan": "15.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "16.0",
"lessThan": "16.20.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "17.0",
"lessThan": "17.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "18.0",
"lessThan": "18.16.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "19.0",
"lessThan": "19.*",
"versionType": "semver",
"status": "affected"
},
{
"version": "20.0",
"lessThan": "20.3.1",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-02T22:34:23.710890Z",
"id": "CVE-2023-30588",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.0.0",
"versionEndExcluding": "16.20.1",
"matchCriteriaId": "7E7F6F9A-AF9F-453B-870D-1E8759567F29"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
"versionStartIncluding": "18.0.0",
"versionEndExcluding": "18.16.1",
"matchCriteriaId": "3AA02CEF-5AC5-46F7-94DE-D9EA15678AE7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
"versionStartIncluding": "20.0.0",
"versionEndExcluding": "20.3.1",
"matchCriteriaId": "1CAA23E6-4930-4326-9CB0-AEE5013BFD37"
}
]
}
]
}
],
"references": [
{
"url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://security.netapp.com/advisory/ntap-20240621-0006/",
"source": "[email protected]"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://security.netapp.com/advisory/ntap-20240621-0006/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20241101-0011/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}