CVE-2023-32006

Name of the Vulnerable Software and Affected Versions Node.js versions 16.x through 20.x

Description The issue is related to the use of module.constructor.createRequire(), which can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This affects all users using the experimental policy mechanism in the mentioned release lines. The policy is an experimental feature of Node.js.

Recommendations For Node.js versions 16.x through 20.x, consider disabling the use of module.constructor.createRequire() until a patch is available to prevent bypassing the policy mechanism. Restrict access to modules outside of the policy.json definition to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.