CVE Feed

    Dashboard / CVE / CVE-2023-30587

    CVE-2023-30587

    A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector). By exploiting the Worker class's ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl. This vulnerability exclusively affects Node.js users employing the permission model mechanism. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

    Published:Jun 20, 2023
    Last Modified:Apr 15, 2026
    EPS:Sep 7, 2024
    EPSS Score:0.00014
    CVSS Score:7.5

    Affected Products

    Vendor
    Nodejs
    Product
    Nodejs

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-48932 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …
    CVE-2026-56848 (CVSS 7.5) — A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2…
    CVE-2026-58042 (CVSS 5.9) — A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than…
    CVE-2026-58044 (CVSS 3.7) — A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that …
    CVE-2026-58045 (CVSS 6.2) — A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchrono…
    CVE-2026-58041 (CVSS 5.3) — A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore…
    CVE-2026-56846 (CVSS 7.5) — A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable re…
    CVE-2026-58039 (CVSS 3.3) — A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --a…
    CVE-2026-56847 (CVSS 6.1) — A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Log…
    CVE-2026-56850 (CVSS 4.4) — A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High