high 7.4

CVE-2023-46809 json

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched ar…

published 2024-09-07 2 y ago modified 2026-06-17 4 mo ago also BIT-node-2023-46809 , BIT-node-min-2023-46809 , EUVD-2023-50975

cvss: 7.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits: 0; none known

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.

Patch / fix

fixed in 3 distros 6

bitnami node 18.19.1, 20.11.1, 21.6.1
bitnami node-min 18.19.1, 20.11.1, 21.6.1
NodeJS Node 18.19.1, 20.11.1, 21.6.2

debian red hat suse opensuse almalinux rocky linux

nodejs Debian 12 18.20.4+dfsg-1~deb12u1
nodejs Debian 14, Debian 13 18.19.1+dfsg-1

debian advisories DEBIAN-CVE-2023-46809

npm RHEL 8 1:10.2.4-1.18.19.1.1.module+el8.9.0+21387+21356dec
nodejs RHEL 8 1:18.19.1-1.module+el8.9.0+21387+21356dec
nodejs-nodemon RHEL 8 3.0.1-1.module+el8.9.0+21190+5ebd2c33
nodejs-full-i18n RHEL 8 1:18.19.1-1.module+el8.9.0+21387+21356dec
nodejs-packaging RHEL 8 2021.06-4.module+el8.9.0+21190+5ebd2c33
nodejs-packaging-bundler RHEL 8 2021.06-4.module+el8.9.0+21190+5ebd2c33
npm RHEL 9 1:10.2.4-1.18.19.1.1.module+el9.3.0+21388+22892fb9
nodejs RHEL 9 1:18.19.1-1.module+el9.3.0+21388+22892fb9

red hat advisories RHSA-2024:1510 RHSA-2024:1503 RHSA-2024:1932 RHSA-2024:1880 RHSA-2024:1687 RHSA-2024:1688

nodejs12 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +4 more 12.22.12-150200.4.56.1
nodejs14 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +4 more 14.21.3-150200.15.55.1
nodejs16 SLE Module for Web and Scripting 12 16.20.2-8.39.1
nodejs18 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Web and Scripting 15 SP5 +4 more 18.19.1-150400.9.18.2
nodejs16 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 16.20.2-150300.7.33.1
nodejs16 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +2 more 16.20.2-150400.3.30.1
nodejs18 SLE Module for Web and Scripting 12 18.19.1-8.18.1
nodejs20 SLE Module for Web and Scripting 15 SP5, openSUSE Leap 15.5 20.11.1-150500.11.6.1

suse advisories SUSE-SU-2024:0733-1 SUSE-SU-2024:0732-1 SUSE-SU-2024:0731-1 SUSE-SU-2024:0730-1 SUSE-SU-2024:0729-1 SUSE-SU-2024:0728-1

nodejs20 openSUSE Tumbleweed 20.11.1-1.1
nodejs21 openSUSE Tumbleweed 21.6.2-1.1

opensuse advisories openSUSE-SU-2024:13697-1 openSUSE-SU-2024:13698-1

npm AlmaLinux 8 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35
nodejs AlmaLinux 8 1:20.11.1-1.module_el8.9.0+3775+d8460d35
nodejs-nodemon AlmaLinux 8 3.0.1-1.module_el8.9.0+3731+490e3ce5
nodejs-full-i18n AlmaLinux 8 1:20.11.1-1.module_el8.9.0+3775+d8460d35
nodejs-packaging AlmaLinux 8 2021.06-4.module_el8.9.0+3684+11b9e959
nodejs-packaging-bundler AlmaLinux 8 2021.06-4.module_el8.9.0+3684+11b9e959
npm AlmaLinux 9 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2
nodejs AlmaLinux 9 1:20.11.1-1.module_el9.3.0+88+29afeaa2

almalinux advisories ALSA-2024:1687 ALSA-2024:1688 ALSA-2024:1510 ALSA-2024:1503

nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32322+a8b1fd01
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.5.0+31770+0da7192d
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32045+2e5d342d
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32143+ae966e5b
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32144+1d29a396
nodejs-nodemon Rocky Linux 9 3.0.1-1.module+el9.6.0+32185+bd121a25
nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.5.0+31770+0da7192d
nodejs-packaging Rocky Linux 9 2021.06-4.module+el9.6.0+32045+2e5d342d

rocky linux advisories RLSA-2024:1688 RLSA-2024:1687 RLSA-2024:1503 RLSA-2024:1510

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-46809 updated 2026-06-26 cvss 5.9

nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)

Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux AppStream (v. 8) nodejs 18.19.1-1.module+el8.9.0+21387+21356dec, nodejs 20.11.1-1.module+el8.9.0+21380+12032667, nodejs-nodemon 3.0.1-1.module+el8.9.0+20473+c4e3d824, nodejs-nodemon 3.0.1-1.module+el8.9.0+21190+5ebd2c33, npm 10.2.4-1.18.19.1.1.module+el8.9.0+21387+21356dec, npm 10.2.4-1.20.11.1.1.module+el8.9.0+21380+12032667, +6 more
fixed: vendor fix RHSA-2024:1510
Red Hat Enterprise Linux AppStream (v. 9) nodejs 18.19.1-1.module+el9.3.0+21388+22892fb9, nodejs 20.11.1-1.module+el9.3.0+21385+bac43d5a, nodejs-nodemon 3.0.1-1.module+el9.3.0+19762+d716bf3b, npm 10.2.4-1.18.19.1.1.module+el9.3.0+21388+22892fb9, npm 10.2.4-1.20.11.1.1.module+el9.3.0+21385+bac43d5a, nodejs-nodemon 3.0.1-1.module+el9.3.0.z+20478+84a9f781, +6 more
fixed: vendor fix RHSA-2024:1503
Red Hat Enterprise Linux AppStream EUS (v.8.8) nodejs 18.19.1-1.module+el8.8.0+21592+14a8b93e, nodejs-nodemon 3.0.1-1.module+el8.8.0+19757+8ca87034, npm 10.2.4-1.18.19.1.1.module+el8.8.0+21592+14a8b93e, nodejs-full-i18n 18.19.1-1.module+el8.8.0+21592+14a8b93e, nodejs-packaging 2021.06-4.module+el8.7.0+15582+19c314fa, nodejs-packaging-bundler 2021.06-4.module+el8.7.0+15582+19c314fa
fixed: vendor fix RHSA-2024:1880
Red Hat Enterprise Linux AppStream EUS (v.9.2) nodejs 18.19.1-1.module+el9.2.0+21594+a052107e, npm 10.2.4-1.18.19.1.1.module+el9.2.0+21594+a052107e, nodejs-nodemon 3.0.1-1.module+el9.2.0.z+19753+58118bc0, nodejs-full-i18n 18.19.1-1.module+el9.2.0+21594+a052107e, nodejs-packaging 2021.06-4.module+el9.1.0+15718+e52ec601, nodejs-packaging-bundler 2021.06-4.module+el9.1.0+15718+e52ec601
fixed: vendor fix RHSA-2024:1932

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-319-08 updated 2024-11-12 cvss 7.4

Siemens SINEC INS

Siemens SINEC INS <V1.0_SP2_Update_3
affected: fixed in V1.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-09-09)

Exploit prediction

1.30% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
OSV	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
bitnami	node	<18.19.1 >=19.0.0, <20.11.1 >=21.0.0, <21.6.1	18.19.1 20.11.1 21.6.1
bitnami	node-min	<18.19.1 >=19.0.0, <20.11.1 >=21.0.0, <21.6.1	18.19.1 20.11.1 21.6.1

Affected products

NodeJS Node
nodejs nodejs

Classification

Weakness

CWE-385 Covert Timing Channel

Technology feeds

Node.js rss critical rss

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary