CVE Feed

    Dashboard / CVE / CVE-2023-30582

    CVE-2023-30582

    A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they do not have explicit read access to. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

    Published:Jun 20, 2023
    Last Modified:Apr 15, 2026
    EPS:Sep 7, 2024
    EPSS Score:0.00098
    CVSS Score:5.3

    Affected Products

    Vendor
    Nodejs
    Product
    Nodejs

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-48932 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …
    CVE-2026-56848 (CVSS 7.5) — A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2…
    CVE-2026-58042 (CVSS 5.9) — A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than…
    CVE-2026-58044 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …
    CVE-2026-58045 (CVSS 6.2) — A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchrono…
    CVE-2026-58041 (CVSS 5.3) — A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore…
    CVE-2026-56846 (CVSS 7.5) — A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable re…
    CVE-2026-58039 (CVSS 3.3) — A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --a…
    CVE-2026-56847 (CVSS 6.1) — A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Log…
    CVE-2026-56850 (CVSS 4.4) — A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High