CVE-2023-46809

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-07 · updated 2026-06-17
Weakness: CWE-385

Description

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.

Affected products

nodejs: from 18.0 through 18.19.0; from 20.0 through 20.11.0; from 21.0 through 21.6.0

References

https://nodejs.org/en/blog/vulnerability/february-2024-security-releases
https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html

Get alerted when CVE-2023-46809 or the next vulnerability affects your stack