| Package | Affected versions | Patched versions |
|---|---|---|
| node.js | ≥ 14.0.0, ≤ 14.14.0≥ 14.0.0, < 14.21.3≥ 16.0.0, ≤ 16.12.0≥ 16.0.0, < 16.19.1≥ 18.0.0, ≤ 18.11.0≥ 18.0.0, < 18.14.1≥ 19.0.0, < 19.6.1 | 14.21.316.19.118.14.119.6.1 |
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free