BIT-node-2023-30581

BIT-node-2023-30581 PUBLISHED CVSS 7.5 HIGH

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products

Vendor	Product	Versions
Bitnami	node	16.0.0, 18.0.0, 20.0.0

Timeline

Mar 6, 2024 CVE Published
Nov 6, 2025 CVE Updated

References

https://nodejs.org/en/blog/vulnerability/june-2023-security-releases url
https://nvd.nist.gov/vuln/detail/CVE-2023-30581 url
https://security.netapp.com/advisory/ntap-20241101-0011/ url

Open in Interactive Console →