CVE-2023-38552

nodejs: integrity checks according to policies can be circumvented

Loading…

Severity

Moderate

Red Hat Product Security

7.5

CVSS 3.1

Review impact separately from score.

Published · October 13, 2023

Updated · November 21, 2025

Description

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to node's policy implementation, thus effectively disabling the integrity check.

Statement

The vulnerability is triggered in an experimental feature that is not widely deployed at the time this vulnerability was disclosed, which is why Red Hat has marked this vulnerability as moderate.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-354 · Improper Validation of Integrity Check Value