When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check.
Impacts:
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00397.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
NodeJS Node unaffected
Version Status Constraints
4.0 affected < 4.*
5.0 affected < 5.*
6.0 affected < 6.*
7.0 affected < 7.*
8.0 affected < 8.*
9.0 affected < 9.*
10.0 affected < 10.*
11.0 affected < 11.*
12.0 affected < 12.*
13.0 affected < 13.*
14.0 affected < 14.*
15.0 affected < 15.*
16.0 affected < 16.*
17.0 affected < 17.*
18.0 affected < 18.18.2
19.0 affected < 19.*
20.0 affected < 20.8.1

Configuration 1 [-]

OR cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
nodejs:18-8080020231015215042.63b34585 cpe:/a:redhat:enterprise_linux:8 RHSA-2023:5869 2023-10-18T00:00:00Z
nodejs:20-8090020231019152822.a75119d5 cpe:/a:redhat:enterprise_linux:8 RHSA-2023:7205 2023-11-14T00:00:00Z
Red Hat Enterprise Linux 9
nodejs:18-9020020231015221156.rhel9 cpe:/a:redhat:enterprise_linux:9 RHSA-2023:5849 2023-10-18T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Fedoraproject Subscribe
Fedora Subscribe
Nodejs Subscribe
Node.js Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
Advisories
Source ID Title
Debian DSA Debian DSA DSA-5589-1 nodejs security update
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://hackerone.com/reports/2094235 cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-38552 cve-icon
https://security.netapp.com/advisory/ntap-20231116-0013/ cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20241108-0002/ cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-38552 cve-icon
History

Mon, 03 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00137}

 epss

{'score': 0.0014}

Wed, 27 Nov 2024 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2025-11-03T21:49:14.670Z

Reserved: 2023-07-20T01:00:12.444Z

Link: CVE-2023-38552

cve-icon Vulnrichment

Updated: 2024-08-02T17:46:56.500Z

cve-icon NVD

Status : Modified

Published: 2023-10-18T04:15:11.200

Modified: 2025-11-03T22:16:24.850

Link: CVE-2023-38552

cve-icon Redhat

Severity : Moderate

Publid Date: 2023-10-13T00:00:00Z

Links: CVE-2023-38552 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses