vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-46809

HIGH
7.4
CVSS Score
Published: September 7, 2024 at 04:03 PM UTC
Updated: June 17, 2026 at 06:31 AM UTC
1 product affected across 1 vendorNode.js

Using Node by NodeJS?

Get instant alerts when new vulnerabilities affect Node - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.4
Exploit prediction
EPSS 1%
SSVC
No known exploit

Description

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Node.js· Node.js
60%
10.0 ≤ v < 10.*11.0 ≤ v < 11.*12.0 ≤ v < 12.*13.0 ≤ v < 13.*14.0 ≤ v < 14.*15.0 ≤ v < 15.*16.0 ≤ v < 16.*17.0 ≤ v < 17.*18.0 ≤ v ≤ 18.19.019.0 ≤ v < 19.*20.0 ≤ v ≤ 20.11.021.0 ≤ v ≤ 21.6.021.0 ≤ v < 21.6.24.0 ≤ v < 4.*5.0 ≤ v < 5.*6.0 ≤ v < 6.*7.0 ≤ v < 7.*8.0 ≤ v < 8.*9.0 ≤ v < 9.*10.011.012.013.014.015.016.017.018.019.020.021.04.05.06.07.08.09.0
Affected range stops below 10.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 11.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 12.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 13.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 14.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 15.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 16.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 17.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 18.19.1, so it looks safe — our inference, not a vendor statement
Affected range stops below 19.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 20.11.1, so it looks safe — our inference, not a vendor statement
Affected range stops below 21.6.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 7.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.*, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.*, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (3)

Source: [email protected]
https://nodejs.org/en/blog/vulnerability/february-2024-security-releases
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.4HIGHCISA-ADP
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-385

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card