CVE-2024-22017: Node.js Node

High severity, CVSS 7.3. EPSS: 0.9% chance of exploitation in the next 30 days.

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Affected products

• Node.js Node: from 4.0, before 5 (fixed in 5); from 5.0, before 6 (fixed in 6); from 6.0, before 7 (fixed in 7); from 7.0, before 8 (fixed in 8); from 8.0, before 9 (fixed in 9); from 9.0, before 10 (fixed in 10); …
• Node.js Node.js: from 18.0.0, before 18.18.0 (fixed in 18.18.0); from 20.0.0, before 20.4.0 (fixed in 20.4.0); from 21.0.0, before 21.6.1 (fixed in 21.6.1)

Published 2024-03-19. Last modified 2026-06-17.