{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2023-23919","sourceIdentifier":"support@hackerone.com","published":"2023-02-23T20:15:13.977","lastModified":"2026-10-24T13:10:00.147","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A cryptographic vulnerability exists in Node.js \u003c19.2.0, \u003c18.14.1, \u003c16.19.1, \u003c14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service."},{"lang":"es","value":"Una vulnerabilidad criptográfica existe en Node.js anterior a 19.2.0, anterior a 18.14.1, anterior a 16.19.1, anterior a 14.21.3 que en algunos casos no limpia la pila de errores de OpenSSL después de operaciones que pueden establecerla. Esto puede llevar a errores de falso positivo durante operaciones criptográficas subsiguientes que se ejecutan en el mismo hilo. Esto a su vez podría usarse para causar una denegación de servicio."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"NodeJS","product":"Node","defaultStatus":"unaffected","versions":[{"version":"4.0","lessThan":"4.*","versionType":"semver","status":"affected"},{"version":"5.0","lessThan":"5.*","versionType":"semver","status":"affected"},{"version":"6.0","lessThan":"6.*","versionType":"semver","status":"affected"},{"version":"7.0","lessThan":"7.*","versionType":"semver","status":"affected"},{"version":"8.0","lessThan":"8.*","versionType":"semver","status":"affected"},{"version":"9.0","lessThan":"9.*","versionType":"semver","status":"affected"},{"version":"10.0","lessThan":"10.*","versionType":"semver","status":"affected"},{"version":"11.0","lessThan":"11.*","versionType":"semver","status":"affected"},{"version":"12.0","lessThan":"12.*","versionType":"semver","status":"affected"},{"version":"13.0","lessThan":"13.*","versionType":"semver","status":"affected"},{"version":"14.0","lessThan":"14.21.3","versionType":"semver","status":"affected"},{"version":"15.0","lessThan":"15.*","versionType":"semver","status":"affected"},{"version":"16.0","lessThan":"16.19.1","versionType":"semver","status":"affected"},{"version":"17.0","lessThan":"17.*","versionType":"semver","status":"affected"},{"version":"18.0","lessThan":"18.14.1","versionType":"semver","status":"affected"},{"version":"19.0","lessThan":"19.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-03-12T14:26:46.934403Z","id":"CVE-2023-23919","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-310"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-Other"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"14.0.0","versionEndIncluding":"14.14.0","matchCriteriaId":"428DCD7B-6F66-4F18-B780-5BD80143D482"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*","versionStartIncluding":"14.0.0","versionEndExcluding":"14.21.3","matchCriteriaId":"DA48F3CE-68BC-43F1-9428-A9F928420081"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"16.0.0","versionEndIncluding":"16.12.0","matchCriteriaId":"1D1D0CEC-62E5-4368-B8F2-1DA5DD0B88FA"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*","versionStartIncluding":"16.0.0","versionEndExcluding":"16.19.1","matchCriteriaId":"6E9FAEC6-2D3A-4CBE-859F-11BCECC4F724"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"18.0.0","versionEndIncluding":"18.11.0","matchCriteriaId":"33DB62F6-9D8D-42F8-A75E-82DA091C02BC"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*","versionStartIncluding":"18.0.0","versionEndExcluding":"18.14.1","matchCriteriaId":"80500AD0-17C2-4698-AE03-1C6782FD38B0"},{"vulnerable":true,"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionStartIncluding":"19.0.0","versionEndExcluding":"19.2.0","matchCriteriaId":"57BCF42B-D5BC-433A-A4BA-E3014E275FA7"}]}]}],"references":[{"url":"https://hackerone.com/reports/1808596","source":"support@hackerone.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/","source":"support@hackerone.com","tags":["Patch","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230316-0008/","source":"support@hackerone.com"},{"url":"https://hackerone.com/reports/1808596","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230316-0008/","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}