CVE catalog
CVE-2023-39333
nodejs: CVE-2023-39333
- Severity
- Medium · CVSS 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.11% · Oct 25, 2026
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | nodejs | sid | 24.22.1+dfsg+~cs24.19.2-1 | fixed |
| Debian | nodejs | forky | 24.21.0+dfsg+~cs24.13.4-1 | fixed |
| Debian | nodejs | trixie | 20.19.2+dfsg-1+deb13u2 | fixed |
| Debian | nodejs | trixie-security | 20.19.2+dfsg-1+deb13u3 | fixed |
| Debian | nodejs | bookworm | 18.20.4+dfsg-1~deb12u2 | fixed |
| Debian | nodejs | bookworm-security | 18.20.4+dfsg-1~deb12u3 | fixed |
| Alpine | nodejs | 3.17 | 18.18.2-r0 | fixed |
| Alpine | nodejs | 3.18 | 18.18.2-r0 | fixed |
| Alpine | nodejs | 3.19 | 18.18.2-r0 | fixed |
| Alpine | nodejs | 3.20 | 18.18.2-r0 | fixed |
| Alpine | nodejs | 3.21 | 18.18.2-r0 | fixed |
| Alpine | nodejs | 3.22 | 18.18.2-r0 | fixed |
| Alpine | nodejs | 3.23 | 18.18.2-r0 | fixed |
| Alpine | nodejs | 3.24 | 18.18.2-r0 | fixed |
| Ubuntu | nodejs | pro | 12.22.5~dfsg-5ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.7~dfsg-2ubuntu1 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.7~dfsg-2ubuntu3 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu2 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.1 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.2 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.3 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.4 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.5 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.6 | vulnerable |
| Ubuntu | nodejs | pro | 12.22.9~dfsg-1ubuntu3.6+esm2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | nodejs | source | sid | 18.13.0+dfsg1-1.1 | not yet assigned | Not reported | [1054892] |
| Debian | nodejs | source | forky | 18.13.0+dfsg1-1.1 | not yet assigned | Not reported | [1054892] |
| Debian | nodejs | source | trixie | 18.13.0+dfsg1-1.1 | not yet assigned | Not reported | [1054892] |
| Debian | nodejs | source | bookworm | 18.19.0+dfsg-6~deb12u1 | not yet assigned | Not reported | [1054892] |
| Alpine | nodejs | apk | 3.17 | 18.18.2-r0 | Not reported | ALPINE-CVE-2023-39333 | Not reported |
| Alpine | nodejs | apk | 3.18 | 18.18.2-r0 | Not reported | ALPINE-CVE-2023-39333 | Not reported |
| Alpine | nodejs | apk | 3.19 | 18.18.2-r0 | Not reported | ALPINE-CVE-2023-39333 | Not reported |
| Alpine | nodejs | apk | 3.20 | 18.18.2-r0 | Not reported | ALPINE-CVE-2023-39333 | Not reported |
| Alpine | nodejs | apk | 3.21 | 18.18.2-r0 | Not reported | ALPINE-CVE-2023-39333 | Not reported |
| Alpine | nodejs | apk | 3.22 | 18.18.2-r0 | Not reported | ALPINE-CVE-2023-39333 | Not reported |
| Alpine | nodejs | apk | 3.23 | 18.18.2-r0 | Not reported | ALPINE-CVE-2023-39333 | Not reported |
| Alpine | nodejs | apk | 3.24 | 18.18.2-r0 | Not reported | ALPINE-CVE-2023-39333 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://access.redhat.com/errata/RHSA-2023:5849]
- [https://cert-portal.siemens.com/productcert/csaf/ssa-915275.json]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13340-1.json]
- [https://osv.dev/vulnerability/ALPINE-CVE-2023-39333]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-39333]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2023-39333]
- [https://security-tracker.debian.org/tracker/CVE-2023-39333]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2655.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]