medium 5.3

CVE-2023-39333 json

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code.

published 2024-09-07 2 y ago modified 2026-06-17 4 mo ago also BIT-node-2023-39333 , BIT-node-min-2023-39333 , EUVD-2023-43064

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.

Patch / fix

fixed in 4 distros 7

bitnami node 18.18.2, 20.8.1
bitnami node-min 18.18.2, 20.8.1
NodeJS Node 18.18.2, 20.8.1
nodejs nodejs 18.18.2, 20.8.1

debian red hat suse opensuse almalinux rocky linux alpine

nodejs Debian 12 18.19.0+dfsg-6~deb12u1
nodejs Debian 14, Debian 13 18.13.0+dfsg1-1.1

debian advisories DEBIAN-CVE-2023-39333

npm RHEL 8 1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824
nodejs RHEL 8 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-nodemon RHEL 8 3.0.1-1.module+el8.9.0+20473+c4e3d824
nodejs-full-i18n RHEL 8 1:20.8.1-1.module+el8.9.0+20473+c4e3d824
nodejs-packaging RHEL 8 2021.06-4.module+el8.9.0+19519+e25b965a
nodejs-packaging-bundler RHEL 8 2021.06-4.module+el8.9.0+19519+e25b965a
npm RHEL 8 1:9.8.1-1.18.18.2.1.module+el8.8.0+20407+c11d40bd
nodejs RHEL 8 1:18.18.2-1.module+el8.8.0+20407+c11d40bd

red hat advisories RHSA-2023:7205 RHSA-2023:5869 RHSA-2023:5849

nodejs16 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +3 more 16.20.2-150300.7.30.1
nodejs16 SLE Module for Web and Scripting 15 SP4 16.20.2-150400.3.27.2
nodejs16 SLE Module for Web and Scripting 12 16.20.2-8.36.1
nodejs18 SLE Module for Web and Scripting 15 SP5, SLE Module for Web and Scripting 15 SP4 18.18.2-150400.9.15.1
nodejs18 SLE Module for Web and Scripting 12 18.18.2-8.15.1

suse advisories SUSE-SU-2023:4207-1 SUSE-SU-2023:4155-1 SUSE-SU-2023:4150-1 SUSE-SU-2023:4133-1 SUSE-SU-2023:4132-1

nodejs20 openSUSE Tumbleweed 20.8.1-1.1
nodejs-electron openSUSE Tumbleweed 25.9.1-2.1

opensuse advisories openSUSE-SU-2024:13337-1 openSUSE-SU-2024:13340-1

npm AlmaLinux 8 1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9
nodejs AlmaLinux 8 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-nodemon AlmaLinux 8 3.0.1-1.module_el8.9.0+3675+0258a6d9
nodejs-full-i18n AlmaLinux 8 1:20.8.1-1.module_el8.9.0+3675+0258a6d9
nodejs-packaging AlmaLinux 8 2021.06-4.module_el8.9.0+3684+11b9e959
nodejs-packaging-bundler AlmaLinux 8 2021.06-4.module_el8.9.0+3684+11b9e959
npm AlmaLinux 9 1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20
nodejs AlmaLinux 9 1:18.18.2-2.module_el9.2.0+43+3ebc9e20

almalinux advisories ALSA-2023:7205 ALSA-2023:5849 ALSA-2023:5869

nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.7.0+40017+f0db1785
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.7.0+40018+a011993d
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.7.0+40022+9ecc286c
nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40022+9ecc286c
nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40025+0e0cf6b2
nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40018+a011993d
nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.7.0+40017+f0db1785
nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1824+532140ee

rocky linux advisories RLSA-2023:5849 RLSA-2023:5869 RLSA-2023:7205

nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 18.18.2-r0
nodejs-current Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 20.8.1-r0

alpine advisories ALPINE-CVE-2023-39333

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-39333 updated 2026-11-07 cvss 5.3

nodejs: code injection via WebAssembly export names

Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n
affected: no fix available “Fix deferred”
Red Hat Enterprise Linux AppStream (v. 8) nodejs 20.8.1-1.module+el8.9.0+20473+c4e3d824, nodejs 18.18.2-1.module+el8.8.0+20407+c11d40bd, npm 10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824, npm 9.8.1-1.18.18.2.1.module+el8.8.0+20407+c11d40bd, nodejs-nodemon 3.0.1-1.module+el8.8.0+19757+8ca87034, nodejs-nodemon 3.0.1-1.module+el8.9.0+20473+c4e3d824, +6 more
fixed: vendor fix RHSA-2023:5869
Red Hat Enterprise Linux AppStream (v. 9) nodejs 18.18.2-2.module+el9.2.0.z+20408+7cb5fda5, npm 9.8.1-1.18.18.2.2.module+el9.2.0.z+20408+7cb5fda5, nodejs-nodemon 3.0.1-1.module+el9.2.0.z+19753+58118bc0, nodejs-packaging 2021.06-4.module+el9.1.0+15718+e52ec601, nodejs-full-i18n 18.18.2-2.module+el9.2.0.z+20408+7cb5fda5, nodejs-packaging-bundler 2021.06-4.module+el9.1.0+15718+e52ec601
fixed: vendor fix RHSA-2023:5849
Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-319-08 updated 2024-11-12 cvss 6.1

Siemens SINEC INS

Siemens SINEC INS <V1.0_SP2_Update_3
affected: fixed in V1.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago (2024-09-09)

Exploit prediction

1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
OSV	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
bitnami	node	<18.18.2 >=19.0.0, <20.8.1	18.18.2 20.8.1
bitnami	node-min	<18.18.2 >=19.0.0, <20.8.1	18.18.2 20.8.1

Affected products

NodeJS Node
nodejs nodejs

Classification

Weakness

CWE-94 Improper Control of Generation of Code

Technology feeds

Node.js rss critical rss

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary