Description
The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 11 | | =12.21.0~dfsg-5 || =12.22.10~dfsg-1 || =12.22.10~dfsg-2 || =12.22.12~dfsg-1~deb11u1 || =12.22.12~dfsg-1~deb11u2 || =12.22.12~dfsg-1~deb11u3 || =12.22.12~dfsg-1~deb11u4 || =12.22.12~dfsg-1~deb11u5 || =12.22.12~dfsg-1~deb11u6 || =12.22.12~dfsg-1~deb11u7 || =12.22.12~dfsg-1~deb11u8 || =12.22.4~dfsg-1 || =12.22.5~dfsg-1 || =12.22.5~dfsg-2 || =12.22.5~dfsg-2~11u1 || =12.22.5~dfsg-3 || =12.22.5~dfsg-4 || =12.22.5~dfsg-5 || =12.22.5~dfsg-6 || =12.22.5~dfsg-7 || =12.22.7~dfsg-1 || =12.22.7~dfsg-2 || =12.22.9~dfsg-1 || =14.11.0~dfsg-1 || =14.11.0~dfsg-2 || =14.12.0~dfsg-1 || =14.13.0~dfsg-1 || =14.16.0~dfsg-1 || =14.16.1~dfsg-1 || =14.17.0~dfsg-1 || =14.17.0~dfsg-2 || =14.4.0~dfsg-1 || =14.4.0~dfsg-2 || =14.7.0~dfsg-1 || =14.8.0~dfsg-1 || =14.9.0~dfsg-1 || =16.11.1~dfsg-1 || =16.13.0~dfsg-1 || =16.13.0~dfsg-2 || =16.13.0~dfsg-3 || =16.13.0~dfsg-4 || =16.13.0~dfsg-5 || =16.13.2+really14.19.0~dfsg-1 || =16.13.2+really14.19.0~dfsg-2 || =16.13.2+really14.19.1~dfsg-1 || =16.13.2+really14.19.1~dfsg-2 || =16.13.2+really14.19.1~dfsg-3 || =16.13.2+really14.19.1~dfsg-4 || =16.13.2+really14.19.1~dfsg-5 || =16.13.2+really14.19.1~dfsg-6 || =16.13.2~dfsg-1 || =16.13.2~dfsg-2 || =16.14.2+dfsg-1 || =16.14.2+dfsg-2 || =16.14.2+dfsg-3 || =16.14.2+dfsg-4 || =16.14.2+dfsg-5 || =16.14.2+dfsg1-1 || =16.15.0+dfsg-1 || =16.15.1+dfsg-1 || =18.10.0+dfsg-1 || =18.10.0+dfsg-2 || =18.10.0+dfsg-3 || =18.10.0+dfsg-4 || =18.10.0+dfsg-5 || =18.10.0+dfsg-6 || =18.11.0+dfsg-1 || =18.11.0+dfsg-2 || =18.11.0+dfsg-3 || =18.11.0+dfsg-4 || =18.12.0+dfsg-1 || =18.12.1+dfsg-1 || =18.12.1+dfsg-2 || =18.12.1+dfsg-2+0.riscv64.1 || =18.13.0+dfsg-1 || =18.13.0+dfsg1-1 || =18.13.0+dfsg1-1.1 || =18.19.0+dfsg-1 || =18.19.0+dfsg-2 || =18.19.0+dfsg-3 || =18.19.0+dfsg-4 || =18.19.0+dfsg-5 || =18.19.0+dfsg-6 || =18.19.0+dfsg-6~deb12u1 || =18.19.0+dfsg-6~deb12u2 || =18.19.1+dfsg-1 || =18.19.1+dfsg-2 || =18.19.1+dfsg-3 || =18.19.1+dfsg-3.1 || =18.19.1+dfsg-4 || =18.19.1+dfsg-6 || =18.20.1+dfsg-1 || =18.20.1+dfsg-2 || =18.20.1+dfsg-3 || =18.20.1+dfsg-4 || =18.20.4+dfsg-1~deb12u1 || =18.20.4+dfsg-1~deb12u2 || =18.3.0+dfsg-1 || =18.4.0+dfsg-1 || =18.4.0+dfsg-2 || =18.6.0+dfsg-1 || =18.6.0+dfsg-2 || =18.6.0+dfsg-3 || =18.6.0+dfsg-4 || =18.6.0+dfsg-5 || =18.7.0+dfsg-1 || =18.7.0+dfsg-4 || =18.7.0+dfsg-5 || =18.8.0+dfsg-1 || =20.10.0+dfsg-1 || =20.12.2+dfsg-1 || =20.13.0+dfsg-1 || =20.13.1+dfsg-1 || =20.13.1+dfsg-2 || =20.14.0+dfsg-1 || =20.14.0+dfsg-2 || =20.14.0+dfsg-3 || =20.15.0+dfsg-1 || =20.15.1+dfsg-1 || =20.16.0+dfsg-1 || =20.17.0+dfsg-1 || =20.17.0+dfsg-2 || =20.18.0+dfsg-1 || =20.18.0+dfsg-2 || =20.18.1+dfsg-1 || =20.18.1+dfsg-2 || =20.18.2+dfsg-1 || =20.18.2+dfsg-2 || =20.18.2+dfsg-3 || =20.18.2+dfsg-4 || =20.18.3+dfsg-1 || =20.19.0+dfsg-1 || =20.19.0+dfsg-2 || =20.19.0+dfsg1-1 || =20.19.2+dfsg-1 || =20.19.4+dfsg-1 || =20.19.5+dfsg+~cs20.19.12-1 || =20.19.5+dfsg+~cs20.19.12-2 || =20.19.5+dfsg+~cs20.19.12-3 || =20.19.5+dfsg+~cs20.19.12-4 || =20.19.5+dfsg+~cs20.19.24-1 || =22.12.0+dfsg-1 || =22.12.0+dfsg-2 || =22.12.0+dfsg-3 || =22.14.0+dfsg-1 || =22.18.0+dfsg+~cs22.17.2-1 || =22.18.0+dfsg+~cs22.17.2-2 || =22.18.0+dfsg-1 || =22.19.0+dfsg+~cs22.18.0-1 || =22.21.1+dfsg+~cs22.19.0-1 || =22.21.1+dfsg+~cs22.19.0-2 || =22.21.1+dfsg+~cs22.19.0-3 || =22.21.1+dfsg+~cs22.19.0-4 || =22.21.1+dfsg+~cs22.19.0-5 || =22.21.1+dfsg+~cs22.19.0-6 || =22.22.0+dfsg+~cs22.19.13-1 || =22.22.0+dfsg+~cs22.19.13-2 || =22.22.0+dfsg+~cs22.19.6-1 || =22.22.1+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-1 || =22.22.2+dfsg+~cs22.19.15-3 || =24.11.1+dfsg+~cs24.10.1-1 || =24.11.1+dfsg+~cs24.10.1-2 || =24.12.0+dfsg+~cs24.10.4-1 || =24.13.0+dfsg+~cs24.10.7-1 || =24.13.0+dfsg+~cs24.10.7-2 || =24.14.0+dfsg+~cs24.12.0-1 || =24.14.0+dfsg+~cs24.12.0-2 || =24.14.1+dfsg+~cs24.12.0-1 || =24.15.0+dfsg+~cs24.12.2-1 || =24.16.0+dfsg+~cs24.13.1-1 || =24.16.0+dfsg+~cs24.13.1-2 || =24.17.0+dfsg+~cs24.13.2-1 || =24.18.0+dfsg+~cs24.13.2-1 || =24.19.0+dfsg+~cs24.13.3-1 | - |
debian 12 | | =18.13.0+dfsg1-1 || =18.13.0+dfsg1-1.1 || =18.19.0+dfsg-1 || =18.19.0+dfsg-2 || =18.19.0+dfsg-3 || =18.19.0+dfsg-4 || =18.19.0+dfsg-5 || >=0 <18.19.0+dfsg-6~deb12u1 | 18.19.0+dfsg-6~deb12u1 |
debian 13 | | | 18.13.0+dfsg1-1.1 |
debian 14 | | | 18.13.0+dfsg1-1.1 |
 rpm rhel8 | | - | - |
rpm rhel8.6 | | <1:16.20.2-2.module+el8.6.0+19897+9590a839 | 1:16.20.2-2.module+el8.6.0+19897+9590a839 |
rpm rhel9 | | | 1:16.20.1-1.el9_2 |
rpm rhel9.0 | | | 1:16.20.2-1.el9_0 |
 npm | | >=16.0.0 <16.20.1 || >=18.0.0 <18.16.1 || >=20.0.0 <20.3.1 | 16.20.1, 18.16.1, 20.3.1 |
