CVE catalog
CVE-2023-30590
nodejs: CVE-2023-30590
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.46% · Oct 25, 2026
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | nodejs | sid | 24.22.1+dfsg+~cs24.19.2-1 | fixed |
| Debian | nodejs | forky | 24.21.0+dfsg+~cs24.13.4-1 | fixed |
| Debian | nodejs | trixie | 20.19.2+dfsg-1+deb13u2 | fixed |
| Debian | nodejs | trixie-security | 20.19.2+dfsg-1+deb13u3 | fixed |
| Debian | nodejs | bookworm | 18.20.4+dfsg-1~deb12u2 | fixed |
| Debian | nodejs | bookworm-security | 18.20.4+dfsg-1~deb12u3 | fixed |
| Cpe | node.js | Not reported | 20.3.1 | fixed |
| Ubuntu | nodejs | pro | 6.11.4~dfsg-1ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 6.11.4~dfsg-1ubuntu2 | vulnerable |
| Ubuntu | nodejs | pro | 6.12.0~dfsg-1ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 6.12.0~dfsg-2ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 6.12.0~dfsg-2ubuntu2 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.2 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.3 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4+esm1 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4+esm2 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4+esm3 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4+esm4 | vulnerable |
| Ubuntu | nodejs | pro | 8.10.0~dfsg-2ubuntu0.4+esm5 | fixed |
| Ubuntu | nodejs | 20.04 | 10.15.2~dfsg-2ubuntu1 | vulnerable |
| Ubuntu | nodejs | 20.04 | 10.17.0~dfsg-2ubuntu4 | vulnerable |
| Ubuntu | nodejs | 20.04 | 10.17.0~dfsg-2ubuntu6 | vulnerable |
| Ubuntu | nodejs | 20.04 | 10.19.0~dfsg-3ubuntu1 | vulnerable |
| Ubuntu | nodejs | 20.04 | 10.19.0~dfsg-3ubuntu1.1 | vulnerable |
| Ubuntu | nodejs | 20.04 | 10.19.0~dfsg-3ubuntu1.2 | vulnerable |
| Ubuntu | nodejs | 20.04 | 10.19.0~dfsg-3ubuntu1.3 | vulnerable |
| Ubuntu | nodejs | 20.04 | 10.19.0~dfsg-3ubuntu1.5 | vulnerable |
| Ubuntu | nodejs | 20.04 | 10.19.0~dfsg-3ubuntu1.6 | fixed |
| Ubuntu | nodejs | 22.04 | 12.22.5~dfsg-5ubuntu1 | vulnerable |
| Ubuntu | nodejs | 22.04 | 12.22.7~dfsg-2ubuntu1 | vulnerable |
| Ubuntu | nodejs | 22.04 | 12.22.7~dfsg-2ubuntu3 | vulnerable |
| Ubuntu | nodejs | 22.04 | 12.22.9~dfsg-1ubuntu2 | vulnerable |
| Ubuntu | nodejs | 22.04 | 12.22.9~dfsg-1ubuntu3 | vulnerable |
| Ubuntu | nodejs | 22.04 | 12.22.9~dfsg-1ubuntu3.1 | vulnerable |
| Ubuntu | nodejs | 22.04 | 12.22.9~dfsg-1ubuntu3.2 | vulnerable |
| Ubuntu | nodejs | 22.04 | 12.22.9~dfsg-1ubuntu3.3 | vulnerable |
| Ubuntu | nodejs | 22.04 | 12.22.9~dfsg-1ubuntu3.4 | vulnerable |
| Ubuntu | nodejs | 22.04 | 12.22.9~dfsg-1ubuntu3.5 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | nodejs | source | sid | 18.13.0+dfsg1-1.1 | not yet assigned | Not reported | [1039990] |
| Debian | nodejs | source | forky | 18.13.0+dfsg1-1.1 | not yet assigned | Not reported | [1039990] |
| Debian | nodejs | source | trixie | 18.13.0+dfsg1-1.1 | not yet assigned | Not reported | [1039990] |
| Debian | nodejs | source | bookworm | 18.19.0+dfsg-6~deb12u1 | not yet assigned | Not reported | [1039990] |
| Cpe | node.js | cpe | Not reported | 20.3.1 | Not reported | NVD-CVE-2023-30590 | Not reported |
| Ubuntu | nodejs | deb | pro | 8.10.0~dfsg-2ubuntu0.4+esm5 | Not reported | UBUNTU-CVE-2023-30590 | Not reported |
| Ubuntu | nodejs | deb | 20.04 | 10.19.0~dfsg-3ubuntu1.6 | Not reported | UBUNTU-CVE-2023-30590 | Not reported |
| Ubuntu | nodejs | deb | 22.04 | 12.22.9~dfsg-1ubuntu3.5 | Not reported | UBUNTU-CVE-2023-30590 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://access.redhat.com/errata/RHSA-2023:4330]
- [https://cert-portal.siemens.com/productcert/csaf/ssa-943925.json]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2023_4536.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2023-30590]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-30590]
- [https://osv.dev/vulnerability/DLA-3776-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2023-30590]
- [https://security-tracker.debian.org/tracker/CVE-2023-30590]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2917.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]