CVE-2023-23918: Node.js

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.

Affected products

• Node.js Node.js: from 14.0.0, up to and including 14.14.0; from 14.0.0, before 14.21.3 (fixed in 14.21.3); from 16.0.0, up to and including 16.12.0; from 16.0.0, before 16.19.1 (fixed in 16.19.1); from 18.0.0, up to and including 18.11.0; from 18.0.0, before 18.14.1 (fixed in 18.14.1); …

Published 2023-02-23. Last modified 2026-06-17.