Dashboard / CVE-2023-23919

CVE-2023-23919

HIGH
MEDIUM Priority: 0.17 BB Relevance: 75/100
Published: 2023-02-23 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: None
A: High

Description

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
nodejs node.js 14.0.0 – 14.14.0
nodejs node.js 14.0.0 – 14.21.3

References & Advisories (3)

https://hackerone.com/reports/1808596
Exploit Third Party Advisory

Bug Bounty Relevance

75 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploitation Probability

2.21%
Raw Score 0.022090
Percentile 82.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.02209
2026-10-28
0.02209

Intelligence Sources

nvd ref →

External Links