CVE-2023-30588

Name of the Vulnerable Software and Affected Versions Node.js versions v16, v18, and v20

Description The issue is related to insufficient input validation in the crypto.X509Certificate() function. When an invalid public key is used to create an x509 certificate, a non-expected termination occurs, making it susceptible to DoS attacks. This happens because the process terminates when accessing public key information from user code, causing the current user context to be lost and leading to a DoS scenario. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For Node.js versions v16, v18, and v20, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.