CVE-2023-30588
Estado: ModificadaMedia (5.3)—
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Puntuación base: 5.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.16%
- Percentil entre todas las CVEs puntuadas: 66
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-noinfo
Referencias
- https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://security.netapp.com/advisory/ntap-20241101-0011/
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-30588",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 1.4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "support@hackerone.com",
"affectedData": [
{
"vendor": "NodeJS",
"product": "Node",
"versions": [
{
"status": "affected",
"version": "4.0",
"lessThan": "4.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.0",
"lessThan": "5.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0",
"lessThan": "6.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.0",
"lessThan": "7.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "8.0",
"lessThan": "8.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "9.0",
"lessThan": "9.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "10.0",
"lessThan": "10.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.0",
"lessThan": "11.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "12.0",
"lessThan": "12.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "13.0",
"lessThan": "13.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "14.0",
"lessThan": "14.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "15.0",
"lessThan": "15.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "16.0",
"lessThan": "16.20.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "17.0",
"lessThan": "17.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "18.0",
"lessThan": "18.16.1",
"versionType": "semver"
},
{
"status": "affected",
"version": "19.0",
"lessThan": "19.*",
"versionType": "semver"
},
{
"status": "affected",
"version": "20.0",
"lessThan": "20.3.1",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2023-11-28T20:15:07.437",
"references": [
{
"url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases",
"tags": [
"Vendor Advisory"
],
"source": "support@hackerone.com"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240621-0006/",
"source": "support@hackerone.com"
},
{
"url": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240621-0006/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20241101-0011/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20."
},
{
"lang": "es",
"value": "Cuando se utiliza una clave pública no válida para crear x509 certificates utilizando la API crypto.X509Certificate(), se produce una terminación no esperada que la hace susceptible a ataques DoS cuando el atacante podría forzar interrupciones en el procesamiento de la aplicación, ya que el proceso finaliza al acceder a la información de clave pública de los certificados proporcionados desde el código de usuario. El contexto actual de los usuarios desaparecerá y eso provocará un escenario DoS. Esta vulnerabilidad afecta a todas las versiones activas de Node.js v16, v18 y v20."
}
],
"lastModified": "2026-06-17T05:55:05.493",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E7F6F9A-AF9F-453B-870D-1E8759567F29",
"versionEndExcluding": "16.20.1",
"versionStartIncluding": "16.0.0"
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3AA02CEF-5AC5-46F7-94DE-D9EA15678AE7",
"versionEndExcluding": "18.16.1",
"versionStartIncluding": "18.0.0"
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1CAA23E6-4930-4326-9CB0-AEE5013BFD37",
"versionEndExcluding": "20.3.1",
"versionStartIncluding": "20.0.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "support@hackerone.com"
}