medium 5.3

CVE-2023-30588 json

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs mak…

published 2023-11-28 2 y ago modified 2026-11-02 6 d ago also BIT-node-2023-30588 , BIT-node-min-2023-30588 , EUVD-2023-34969

cvss: 5.3; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits: 0; none known

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

Patch / fix

fixed in 3 distros 6

bitnami node 16.20.1, 18.16.1, 20.3.1
bitnami node-min 16.20.1, 18.16.1, 20.3.1
NodeJS Node 16.20.1, 18.16.1, 20.3.1

debian red hat suse opensuse almalinux rocky linux

nodejs Debian 12 18.19.0+dfsg-6~deb12u1
nodejs Debian 14, Debian 13 18.13.0+dfsg1-1.1

debian advisories DEBIAN-CVE-2023-30588

npm RHEL 8 1:9.5.1-1.18.16.1.1.module+el8.8.0+19438+94e84959
nodejs RHEL 8 1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-nodemon RHEL 8 2.0.20-2.module+el8.8.0+18432+27f188ac
nodejs-full-i18n RHEL 8 1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-packaging RHEL 8 2021.06-4.module+el8.7.0+15582+19c314fa
nodejs-packaging-bundler RHEL 8 2021.06-4.module+el8.7.0+15582+19c314fa
npm RHEL 8 1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5
nodejs RHEL 8 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5

red hat advisories RHSA-2023:5361 RHSA-2023:5533 RHSA-2023:4536 RHSA-2023:4537 RHSA-2023:4330 RHSA-2023:4331

nodejs16 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +3 more 16.20.1-150300.7.24.2
nodejs18 SLE Module for Web and Scripting 15 SP5, SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.5 +1 more 18.16.1-150400.9.9.1
nodejs16 SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.4 16.20.1-150400.3.21.1
nodejs18 SLE Module for Web and Scripting 12 18.16.1-8.9.1
nodejs16 SLE Module for Web and Scripting 12 16.20.1-8.30.1

suse advisories SUSE-SU-2023:2861-1 SUSE-SU-2023:2669-1 SUSE-SU-2023:2663-1 SUSE-SU-2023:2662-1 SUSE-SU-2023:2655-1

nodejs20 openSUSE Tumbleweed 20.3.1-1.1

opensuse advisories openSUSE-SU-2024:13021-1

npm AlmaLinux 8 1:9.5.1-1.18.16.1.1.module_el8.8.0+3595+0818e803
nodejs AlmaLinux 8 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-nodemon AlmaLinux 8 2.0.20-2.module_el8.8.0+3587+ee652244
nodejs-full-i18n AlmaLinux 8 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-packaging AlmaLinux 8 2021.06-4.module_el8.7.0+3343+ea2b7901
nodejs-packaging-bundler AlmaLinux 8 2021.06-4.module_el8.7.0+3343+ea2b7901
npm AlmaLinux 8 1:8.19.4-1.16.20.1.1.module_el8.8.0+3594+e74fe53f
nodejs AlmaLinux 8 1:16.20.1-1.module_el8.8.0+3594+e74fe53f

almalinux advisories ALSA-2023:4536 ALSA-2023:4537 ALSA-2023:4330 ALSA-2023:4331

nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40022+9ecc286c
nodejs Rocky Linux 8 1:18.16.1-1.module+el8.8.0+1413+a47876c7
nodejs-nodemon Rocky Linux 8 2.0.20-2.module+el8.7.0+1177+510ae886
nodejs-packaging Rocky Linux 8 2021.06-4.module+el8.7.0+1072+5b168780
nodejs-nodemon Rocky Linux 8 2.0.20-3.module+el8.7.0+1178+d52dba78
nodejs-packaging Rocky Linux 8 25-1.module+el8.7.0+1108+49363b0d

rocky linux advisories RLSA-2023:4330 RLSA-2023:4536 RLSA-2023:4537

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-30588 updated 2026-11-06 cvss 5.3

nodejs: process interuption due to invalid Public Key information in x509 certificates

Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux AppStream (v. 8) nodejs 16.20.1-1.module+el8.8.0+19440+ee8dbee5, nodejs 18.16.1-1.module+el8.8.0+19438+94e84959, nodejs-packaging 25-1.module+el8.5.0+10992+fac5fe06, npm 9.5.1-1.18.16.1.1.module+el8.8.0+19438+94e84959, npm 8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5, nodejs-nodemon 2.0.20-2.module+el8.8.0+18432+27f188ac, +5 more
fixed: vendor fix RHSA-2023:4537
Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.20.1-1.el9_2, nodejs-libs 16.20.1-1.el9_2, npm 8.19.4-1.16.20.1.1.el9_2, nodejs-full-i18n 16.20.1-1.el9_2, nodejs 18.16.1-1.module+el9.2.0.z+19424+78951f07, npm 9.5.1-1.18.16.1.1.module+el9.2.0.z+19424+78951f07, +4 more
fixed: vendor fix RHSA-2023:4331
Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs 16.20.2-2.module+el8.6.0+19897+9590a839, nodejs-packaging 26-1.module+el8.6.0+19856+c0c87259, nodejs-nodemon 3.0.1-1.module+el8.6.0+19765+366b9144, npm 8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839, nodejs-full-i18n 16.20.2-2.module+el8.6.0+19897+9590a839
fixed: vendor fix RHSA-2023:5361
Red Hat Enterprise Linux AppStream EUS (v.9.0) nodejs 16.20.2-1.el9_0, nodejs-libs 16.20.2-1.el9_0, npm 8.19.4-1.16.20.2.1.el9_0, nodejs-full-i18n 16.20.2-1.el9_0
fixed: vendor fix RHSA-2023:5533
Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-15 updated 2024-03-12 cvss 5.3

Siemens SINEC NMS

Siemens SINEC NMS <V2.0_SP1
affected: fixed in V2.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 6 d ago (2026-11-02)

Exploit prediction

1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
OSV	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem	package	affected	fixed in
bitnami	node	>=16.0.0, <16.20.1 >=18.0.0, <18.16.1 >=20.0.0, <20.3.1	16.20.1 18.16.1 20.3.1
bitnami	node-min	>=16.0.0, <16.20.1 >=18.0.0, <18.16.1 >=20.0.0, <20.3.1	16.20.1 18.16.1 20.3.1

Affected products

NodeJS Node

Classification

Technology feeds

Node.js rss critical rss

References

nodejs.org /en/blog/vulnerability/june-2023-security-releases
vendor-advisory, advisory
security.netapp.com /advisory/ntap-20240621-0006/
web
security.netapp.com /advisory/ntap-20241101-0011/
web
nvd.nist.gov /vuln/detail/CVE-2023-30588
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary