When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation a

Summary

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Timeline

1. Oct 18, 2023, 3:55 AM UTCCVE published
2. Feb 20, 2024, 3:14 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Nov 3, 2025, 9:49 PM UTCRecord last updated

Affected versions

• NodeJS Node

  From 4.0; From 5.0; From 6.0; From 7.0; From 8.0; From 9.0; From 10.0; From 11.0; From 12.0; From 13.0; From 14.0; From 15.0; From 16.0; From 17.0; From 18.0 · fixed in 18.18.2; From 19.0; From 20.0 · fixed in 20.8.1

References 8