critical
CVE-2023-39332
nodejs: path traversal through path stored in Uint8Array
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami, Photon OS. Rated lower by Red Hat (high), AlmaLinux (high), Oracle (high), Rocky Linux (high).
Description
Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects. This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node, node-min | 20.8.0 |
| Photon OS 5.0 | nodejs, nodejs-devel | 18.18.2-1.ph5 |
| alma 8 | nodejs:20::nodejs, nodejs:20::nodejs-devel, nodejs:20::nodejs-docs and 5 more | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 and 3 more |
| alpine 3.18 | nodejs-current | 20.8.1-r0 |
| alpine 3.19 | nodejs-current | 20.8.1-r0 |
| alpine 3.20 | nodejs-current | 20.8.1-r0 |
| alpine 3.21 | nodejs-current | 20.8.1-r0 |
| alpine 3.22 | nodejs-current | 20.8.1-r0 |
| alpine 3.23 | nodejs-current | 20.8.1-r0 |
| alpine 3.24 | nodejs-current | 20.8.1-r0 |
| alpine edge | nodejs-current | 20.8.1-r0 |
| chainguard | nodejs-16, nodejs-18, nodejs-20 | 0 and 1 more |
Show all 37 entries from 15 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node | 20.8.0 |
| bitnami::Bitnami Vulnerability Database | node-min | 20.8.0 |
| Photon OS 5.0 | nodejs | 18.18.2-1.ph5 |
| Photon OS 5.0 | nodejs-devel | 18.18.2-1.ph5 |
| alma 8 | nodejs:20::nodejs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| alma 8 | nodejs:20::nodejs-devel | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| alma 8 | nodejs:20::nodejs-docs | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| alma 8 | nodejs:20::nodejs-full-i18n | 1:20.8.1-1.module_el8.9.0+3675+0258a6d9 |
| alma 8 | nodejs:20::nodejs-nodemon | 3.0.1-1.module_el8.9.0+3675+0258a6d9 |
| alma 8 | nodejs:20::nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| alma 8 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 |
| alma 8 | nodejs:20::npm | 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9 |
| alpine 3.18 | nodejs-current | 20.8.1-r0 |
| alpine 3.19 | nodejs-current | 20.8.1-r0 |
| alpine 3.20 | nodejs-current | 20.8.1-r0 |
| alpine 3.21 | nodejs-current | 20.8.1-r0 |
| alpine 3.22 | nodejs-current | 20.8.1-r0 |
| alpine 3.23 | nodejs-current | 20.8.1-r0 |
| alpine 3.24 | nodejs-current | 20.8.1-r0 |
| alpine edge | nodejs-current | 20.8.1-r0 |
| chainguard | nodejs-16 | 0 |
| chainguard | nodejs-18 | 0 |
| chainguard | nodejs-20 | 20.8.0-r0 |
| Oracle Linux 8 | nodejs | 1:20.8.1-1.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-devel | 1:20.8.1-1.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-docs | 1:20.8.1-1.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-full-i18n | 1:20.8.1-1.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-packaging | 2021.06-4.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | nodejs-packaging-bundler | 2021.06-4.module+el8.9.0+90082+b6a613a6 |
| Oracle Linux 8 | npm | 1:10.1.0-1.20.8.1.1.module+el8.9.0+90082+b6a613a6 |
| rocky 8 | nodejs:18::nodejs-nodemon | 3.0.1-1.module+el8.8.0+1459+02651ab6 |
| rocky 8 | nodejs:18::nodejs-packaging | 2021.06-4.module+el8.7.0+1072+5b168780 |
| rocky 8 | nodejs:18::nodejs-packaging-bundler | 2021.06-4.module+el8.7.0+1072+5b168780 |
| wolfi | nodejs-16 | 0 |
| wolfi | nodejs-18 | 0 |
| wolfi | nodejs-20 | 20.8.0-r0 |
References
- https://access.redhat.com/errata/RHSA-2023:7205
- https://access.redhat.com/security/cve/CVE-2023-39332
- https://bugzilla.redhat.com/2242803
- https://bugzilla.redhat.com/2244104
- https://bugzilla.redhat.com/2244413
- https://bugzilla.redhat.com/2244414
- https://bugzilla.redhat.com/2244415
- https://bugzilla.redhat.com/2244418
All 31 references
- https://bugzilla.redhat.com/show_bug.cgi?id=2242803
- https://bugzilla.redhat.com/show_bug.cgi?id=2244104
- https://bugzilla.redhat.com/show_bug.cgi?id=2244413
- https://bugzilla.redhat.com/show_bug.cgi?id=2244414
- https://bugzilla.redhat.com/show_bug.cgi?id=2244415
- https://bugzilla.redhat.com/show_bug.cgi?id=2244418
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38552
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39331
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39332
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39333
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45143
- https://errata.almalinux.org/8/ALSA-2023-7205.html
- https://errata.rockylinux.org/RLSA-2023:7205
- https://hackerone.com/reports/2199818
- https://linux.oracle.com/cve/CVE-2023-39332.html
- https://linux.oracle.com/errata/ELSA-2023-7205.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
- https://nvd.nist.gov/vuln/detail/CVE-2023-39332
- https://security.netapp.com/advisory/ntap-20231116-0009/
- https://security.netapp.com/advisory/ntap-20241108-0002/
- https://www.cve.org/CVERecord?id=CVE-2023-39332