high 7.5

CVE-2023-30590 json

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only gene…

published 2023-11-28 2 y ago modified 2026-10-08 31 d ago also BIT-node-2023-30590 , BIT-node-min-2023-30590 , EUVD-2023-34970

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits: 0; none known

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values".

The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.

Patch / fix

fixed in 3 distros 7

bitnami node 16.20.1, 18.16.1, 20.3.1
bitnami node-min 16.20.1, 18.16.1, 20.3.1
NodeJS Node 16.20.1, 18.16.1, 20.3.1

debian ubuntu red hat suse opensuse almalinux rocky linux

nodejs Debian 12 18.19.0+dfsg-6~deb12u1
nodejs Debian 14, Debian 13 18.13.0+dfsg1-1.1

debian advisories DEBIAN-CVE-2023-30590

nodejs Ubuntu 20.04 LTS 10.19.0~dfsg-3ubuntu1.6
nodejs Ubuntu 22.04 LTS 12.22.9~dfsg-1ubuntu3.5
nodejs Ubuntu Pro 14.04 LTS 0.10.25~dfsg2-2ubuntu1.2+esm2
nodejs Ubuntu Pro 16.04 LTS 4.2.6~dfsg-1ubuntu4.2+esm3
nodejs Ubuntu Pro 18.04 LTS 8.10.0~dfsg-2ubuntu0.4+esm5

ubuntu advisories UBUNTU-CVE-2023-30590

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

npm RHEL 8 1:9.5.1-1.18.16.1.1.module+el8.8.0+19438+94e84959
nodejs RHEL 8 1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-nodemon RHEL 8 2.0.20-2.module+el8.8.0+18432+27f188ac
nodejs-full-i18n RHEL 8 1:18.16.1-1.module+el8.8.0+19438+94e84959
nodejs-packaging RHEL 8 2021.06-4.module+el8.7.0+15582+19c314fa
nodejs-packaging-bundler RHEL 8 2021.06-4.module+el8.7.0+15582+19c314fa
npm RHEL 8 1:8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5
nodejs RHEL 8 1:16.20.1-1.module+el8.8.0+19440+ee8dbee5

red hat advisories RHSA-2023:5361 RHSA-2023:5533 RHSA-2023:4536 RHSA-2023:4537 RHSA-2023:4330 RHSA-2023:4331

nodejs12 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +8 more 12.22.12-150200.4.50.1
nodejs14 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +7 more 14.21.3-150200.15.49.1
nodejs14 SLE Module for Web and Scripting 12 14.21.3-6.46.1
nodejs16 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +3 more 16.20.1-150300.7.24.2
nodejs18 SLE Module for Web and Scripting 15 SP5, SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.5 +1 more 18.16.1-150400.9.9.1
nodejs16 SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.4 16.20.1-150400.3.21.1
nodejs18 SLE Module for Web and Scripting 12 18.16.1-8.9.1
nodejs16 SLE Module for Web and Scripting 12 16.20.1-8.30.1

suse advisories SUSE-SU-2023:3455-1 SUSE-SU-2023:3408-1 SUSE-SU-2023:3306-1 SUSE-SU-2023:2861-1 SUSE-SU-2023:2669-1 SUSE-SU-2023:2663-1

nodejs20 openSUSE Tumbleweed 20.3.1-1.1

opensuse advisories openSUSE-SU-2024:13021-1

npm AlmaLinux 8 1:9.5.1-1.18.16.1.1.module_el8.8.0+3595+0818e803
nodejs AlmaLinux 8 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-nodemon AlmaLinux 8 2.0.20-2.module_el8.8.0+3587+ee652244
nodejs-full-i18n AlmaLinux 8 1:18.16.1-1.module_el8.8.0+3595+0818e803
nodejs-packaging AlmaLinux 8 2021.06-4.module_el8.7.0+3343+ea2b7901
nodejs-packaging-bundler AlmaLinux 8 2021.06-4.module_el8.7.0+3343+ea2b7901
npm AlmaLinux 8 1:8.19.4-1.16.20.1.1.module_el8.8.0+3594+e74fe53f
nodejs AlmaLinux 8 1:16.20.1-1.module_el8.8.0+3594+e74fe53f

almalinux advisories ALSA-2023:4536 ALSA-2023:4537 ALSA-2023:4330 ALSA-2023:4331

nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40022+9ecc286c
nodejs Rocky Linux 8 1:18.16.1-1.module+el8.8.0+1413+a47876c7
nodejs-nodemon Rocky Linux 8 2.0.20-2.module+el8.7.0+1177+510ae886
nodejs-packaging Rocky Linux 8 2021.06-4.module+el8.7.0+1072+5b168780
nodejs-nodemon Rocky Linux 8 2.0.20-3.module+el8.7.0+1178+d52dba78
nodejs-packaging Rocky Linux 8 25-1.module+el8.7.0+1108+49363b0d

rocky linux advisories RLSA-2023:4330 RLSA-2023:4536 RLSA-2023:4537

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-30590 updated 2026-11-07 cvss 7.5

nodejs: DiffieHellman do not generate keys after setting a private key

Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux AppStream (v. 8) nodejs 16.20.1-1.module+el8.8.0+19440+ee8dbee5, nodejs 18.16.1-1.module+el8.8.0+19438+94e84959, nodejs-packaging 25-1.module+el8.5.0+10992+fac5fe06, npm 9.5.1-1.18.16.1.1.module+el8.8.0+19438+94e84959, npm 8.19.4-1.16.20.1.1.module+el8.8.0+19440+ee8dbee5, nodejs-nodemon 2.0.20-2.module+el8.8.0+18432+27f188ac, +5 more
fixed: vendor fix RHSA-2023:4537
Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.20.1-1.el9_2, nodejs-libs 16.20.1-1.el9_2, npm 8.19.4-1.16.20.1.1.el9_2, nodejs-full-i18n 16.20.1-1.el9_2, nodejs 18.16.1-1.module+el9.2.0.z+19424+78951f07, npm 9.5.1-1.18.16.1.1.module+el9.2.0.z+19424+78951f07, +4 more
fixed: vendor fix RHSA-2023:4331
Red Hat Enterprise Linux AppStream EUS (v.8.6) nodejs 16.20.2-2.module+el8.6.0+19897+9590a839, nodejs-packaging 26-1.module+el8.6.0+19856+c0c87259, nodejs-nodemon 3.0.1-1.module+el8.6.0+19765+366b9144, npm 8.19.4-1.16.20.2.2.module+el8.6.0+19897+9590a839, nodejs-full-i18n 16.20.2-2.module+el8.6.0+19897+9590a839
fixed: vendor fix RHSA-2023:5361
Red Hat Enterprise Linux AppStream EUS (v.9.0) nodejs 16.20.2-1.el9_0, nodejs-libs 16.20.2-1.el9_0, npm 8.19.4-1.16.20.2.1.el9_0, nodejs-full-i18n 16.20.2-1.el9_0
fixed: vendor fix RHSA-2023:5533

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-15 updated 2024-03-12 cvss 7.5

Siemens SINEC NMS

Siemens SINEC NMS <V2.0_SP1
affected: fixed in V2.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 31 d ago (2026-10-08)

Exploit prediction

1.46% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
bitnami	node	>=16.0.0, <16.20.1 >=18.0.0, <18.16.1 >=20.0.0, <20.3.1	16.20.1 18.16.1 20.3.1
bitnami	node-min	>=16.0.0, <16.20.1 >=18.0.0, <18.16.1 >=20.0.0, <20.3.1	16.20.1 18.16.1 20.3.1

Affected products

NodeJS Node

Classification

Technology feeds

Node.js rss critical rss

References

nodejs.org /en/blog/vulnerability/june-2023-security-releases
vendor-advisory, advisory
lists.debian.org /debian-lts-announce/2024/03/msg00029.html
web
security.netapp.com /advisory/ntap-20241101-0011/
web
lists.debian.org /debian-lts-announce/2024/09/msg00029.html
web
nvd.nist.gov /vuln/detail/CVE-2023-30590
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary