DSA-5395: -1 nodejs -- security update
An untrusted search path vulnerability was discovered in Node.js, which could result in unexpected searching or loading ICU data when running with elevated privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nodejsto a version that resolves this vulnerability.Patch DSA-5395-1
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
The issue is relevant to Node.js processes running with elevated privileges, because the vulnerability can cause unexpected searching or loading of ICU data in that context.
What would an attacker need to exploit it?
The available information identifies an untrusted search path as the underlying condition, but does not specify the exact attacker access, input, or filesystem control required for exploitation.
How can I determine whether a system may be affected?
Review whether Debian Node.js is installed and whether Node.js workloads run with elevated privileges. The advisory identifies CVE-2023-23920 as the tracked vulnerability.