CVE-2023-30584

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-07 · updated 2026-06-17
Weakness: CWE-22

Description

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Affected products

nodejs: from 20.0 before 20.3.1 — fixed in 20.3.1

How to fix

Upgrade to a fixed version: nodejs 20.3.1. Check the vendor advisory for mitigations.

References

https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
https://security.netapp.com/advisory/ntap-20241108-0005/

Get alerted when CVE-2023-30584 or the next vulnerability affects your stack