high 7.5

CVE-2023-30581 json

The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.js…

published 2023-11-22 2 y ago modified 2026-09-08 2 mo ago also BIT-node-2023-30581 , BIT-node-min-2023-30581 , EUVD-2023-34962

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 64%
public exploits: 0; none known

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.

Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

Patch / fix

fixed in 3 distros 6

bitnami node 16.20.1, 18.16.1, 20.3.1
bitnami node-min 16.20.1, 18.16.1, 20.3.1
NodeJS Node 16.20.1, 18.16.1, 20.3.1

debian red hat suse opensuse almalinux rocky linux

nodejs Debian 12 18.19.0+dfsg-6~deb12u1
nodejs Debian 14, Debian 13 18.13.0+dfsg1-1.1

debian advisories DEBIAN-CVE-2023-30581

npm RHEL 8 1:9.5.1-1.18.16.1.1.module+el8.8.0+19438+94e84959
nodejs RHEL 8 1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-nodemon RHEL 8 2.0.20-2.module+el8.8.0+18432+27f188ac
nodejs-full-i18n RHEL 8 1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-packaging RHEL 8 2021.06-4.module+el8.7.0+15582+19c314fa
nodejs-packaging-bundler RHEL 8 2021.06-4.module+el8.7.0+15582+19c314fa
npm RHEL 8 1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5
nodejs RHEL 8 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5

red hat advisories RHSA-2023:5361 RHSA-2023:5533 RHSA-2023:4536 RHSA-2023:4537 RHSA-2023:4330 RHSA-2023:4331

nodejs12 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +8 more 12.22.12-150200.4.50.1
nodejs14 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +7 more 14.21.3-150200.15.49.1
nodejs14 SLE Module for Web and Scripting 12 14.21.3-6.46.1
nodejs16 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +3 more 16.20.1-150300.7.24.2
nodejs18 SLE Module for Web and Scripting 15 SP5, SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.5 +1 more 18.16.1-150400.9.9.1
nodejs16 SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.4 16.20.1-150400.3.21.1
nodejs18 SLE Module for Web and Scripting 12 18.16.1-8.9.1
nodejs16 SLE Module for Web and Scripting 12 16.20.1-8.30.1

suse advisories SUSE-SU-2023:3455-1 SUSE-SU-2023:3408-1 SUSE-SU-2023:3306-1 SUSE-SU-2023:2861-1 SUSE-SU-2023:2669-1 SUSE-SU-2023:2663-1

nodejs20 openSUSE Tumbleweed 20.3.1-1.1

opensuse advisories openSUSE-SU-2024:13021-1

npm AlmaLinux 8 1:9.5.1-1.18.16.1.1.module_el8.8.0+3595+0818e803
nodejs AlmaLinux 8 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-nodemon AlmaLinux 8 2.0.20-2.module_el8.8.0+3587+ee652244
nodejs-full-i18n AlmaLinux 8 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-packaging AlmaLinux 8 2021.06-4.module_el8.7.0+3343+ea2b7901
nodejs-packaging-bundler AlmaLinux 8 2021.06-4.module_el8.7.0+3343+ea2b7901
npm AlmaLinux 8 1:8.19.4-1.16.20.1.1.module_el8.8.0+3594+e74fe53f
nodejs AlmaLinux 8 1:16.20.1-1.module_el8.8.0+3594+e74fe53f

almalinux advisories ALSA-2023:4536 ALSA-2023:4537 ALSA-2023:4330 ALSA-2023:4331

nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40022+9ecc286c
nodejs Rocky Linux 8 1:18.16.1-1.module+el8.8.0+1413+a47876c7
nodejs-nodemon Rocky Linux 8 2.0.20-2.module+el8.7.0+1177+510ae886
nodejs-packaging Rocky Linux 8 2021.06-4.module+el8.7.0+1072+5b168780
nodejs-nodemon Rocky Linux 8 2.0.20-3.module+el8.7.0+1178+d52dba78
nodejs-packaging Rocky Linux 8 25-1.module+el8.7.0+1108+49363b0d

rocky linux advisories RLSA-2023:4330 RLSA-2023:4536 RLSA-2023:4537

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-30581 updated 2026-11-07 cvss 7.5

nodejs: mainModule.proto bypass experimental policy mechanism

Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux AppStream (v. 8) nodejs 16.20.1-1.module+el8.8.0+19440+ee8dbee5, nodejs 18.16.1-1.module+el8.8.0+19438+94e84959, nodejs-packaging 25-1.module+el8.5.0+10992+fac5fe06, npm 9.5.1-1.18.16.1.1.module+el8.8.0+19438+94e84959, npm 8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5, nodejs-nodemon 2.0.20-2.module+el8.8.0+18432+27f188ac, +5 more
fixed: vendor fix RHSA-2023:4537
Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.20.1-1.el9_2, nodejs-libs 16.20.1-1.el9_2, npm 8.19.4-1.16.20.1.1.el9_2, nodejs-full-i18n 16.20.1-1.el9_2, nodejs 18.16.1-1.module+el9.2.0.z+19424+78951f07, npm 9.5.1-1.18.16.1.1.module+el9.2.0.z+19424+78951f07, +4 more
fixed: vendor fix RHSA-2023:4331
Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs 16.20.2-2.module+el8.6.0+19897+9590a839, nodejs-packaging 26-1.module+el8.6.0+19856+c0c87259, nodejs-nodemon 3.0.1-1.module+el8.6.0+19765+366b9144, npm 8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839, nodejs-full-i18n 16.20.2-2.module+el8.6.0+19897+9590a839
fixed: vendor fix RHSA-2023:5361
Red Hat Enterprise Linux AppStream EUS (v.9.0) nodejs 16.20.2-1.el9_0, nodejs-libs 16.20.2-1.el9_0, npm 8.19.4-1.16.20.2.1.el9_0, nodejs-full-i18n 16.20.2-1.el9_0
fixed: vendor fix RHSA-2023:5533

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-15 updated 2024-03-12 cvss 7.5

Siemens SINEC NMS

Siemens SINEC NMS <V2.0_SP1
affected: fixed in V2.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 17 mo ago (2025-06-05)

Exploit prediction

1.05% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
bitnami	node	>=16.0.0, <16.20.1 >=18.0.0, <18.16.1 >=20.0.0, <20.3.1	16.20.1 18.16.1 20.3.1
bitnami	node-min	>=16.0.0, <16.20.1 >=18.0.0, <18.16.1 >=20.0.0, <20.3.1	16.20.1 18.16.1 20.3.1

Affected products

NodeJS Node

Classification

Weakness

CWE-862 Missing Authorization

Technology feeds

Node.js rss critical rss

References

nodejs.org /en/blog/vulnerability/june-2023-security-releases
release-notes, article
security.netapp.com /advisory/ntap-20241101-0011/
web
nvd.nist.gov /vuln/detail/CVE-2023-30581
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary