CVE-2023-30590

A vulnerability has been identified in the Node.js, where a generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet.

The generateKeys() API function returned from crypto.createDiffieHellman() in Node.js does not behave as documented as the documentation states that the function “generates private and public Diffie-Hellman key values.” However, the actual implementation only generates a private key if one has not yet been set, and does not recompute or regenerate the public key if the private key was previously defined using setPrivateKey(), which is why this could only in theory, result in weak or predictable shared secrets. The issue at hand is a developer facing hazard caused by a mismatch in the documentation and application of the function, and is not in itself a security vulnerability, which is why Redhat has assessed this as moderate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.