ALPINE-CVE-2023-32002 — Vulnetix

Try Vulnetix Request Demo

ALPINE-CVE-2023-32002 PUBLISHED CVSS 9.800000190734863 CRITICAL

The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

Risk Scores

CVSS v3.1

9.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Alpine:v3.19	nodejs	6.9.5-r0, 6.9.4-r1, 6.9.4-r0
Alpine:v3.15	nodejs	14.17.3-r0, 0, 10.13.0-r0
Alpine:v3.22	nodejs	0, 0, 0
Alpine:v3.17	nodejs	4.4.4-r0, 4.4.7-r0, 4.5.0-r0
Alpine:v3.23	nodejs	0, 0, 0
Alpine:v3.18	nodejs	8.10.0-r0, 8.11.3-r1, 8.11.1-r1
Alpine:v3.21	nodejs	0, 0, 0
Alpine:v3.16	nodejs	14.16.1-r1, 8.9.4-r0, 8.9.3-r1
Alpine:v3.20	nodejs	14.16.0-r0, 14.16.0-r1, 14.16.1-r0

Timeline

Aug 21, 2023 CVE Published
Dec 3, 2025 CVE Updated
Apr 30, 2026 Distribution Patch

References

https://security.alpinelinux.org/vuln/CVE-2023-32002 advisory

Open in Interactive Console →