CVE-2023-0465

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development. The official Node.js distributions do not link against a system cryptography library: they compile and ship their own copy of OpenSSL inside the runtime, at deps/openssl in the Node.js source tree, and the built-in crypto and tls modules are bindings over that bundled copy. A vulnerability in the bundled OpenSSL therefore affects Node.js directly, whether or not Node.js itself contains any new code.

An improper certificate validation vulnerability (CVE-2023-0465) has been identified in the OpenSSL library bundled with Node.js: invalid certificate policies asserted in a leaf certificate are silently ignored by OpenSSL, and OpenSSL then skips the remaining certificate policy checks for that certificate altogether, instead of failing verification.

Per OWASP, improper certificate validation occurs “when a certificate is not properly validated, which can allow an attacker to impersonate a trusted entity.”

A malicious Certificate Authority could exploit this to deliberately assert invalid certificate policies in a leaf certificate, in order to circumvent policy checking on that certificate altogether. Policy processing is disabled by default in OpenSSL and is not commonly used by applications; this issue only affects Node.js applications, or dependencies of a Node.js application, that explicitly enable X.509 policy-constraint checking (via the -policy command line argument or the X509_VERIFY_PARAM_set1_policies() function). This issue affects the Node.js 12.x, 14.x, 16.x, 17.x, 18.x, 19.x, and 20.x release lines up to the versions listed below; Node.js 22.x and 24.x never bundled a vulnerable OpenSSL version and are not affected.

Details

Module Info

• Product: Node.js
• Affected packages: node (bundles OpenSSL under deps/openssl)
• Affected versions:
  • >=12.0.0 <=12.22.12
  • >=14.0.0 <=14.21.3
  • >=16.0.0 <16.20.1
  • >=17.0.0 <=17.9.1
  • >=18.0.0 <18.16.1
  • >=19.0.0 <=19.9.0
  • >=20.0.0 <20.3.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable — Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package.
• Fixed in:
  
  • Upstream Node.js 16.20.1, 18.16.1, and 20.3.1, released while those lines were still in active support.
  • Node.js NES v14.21.4 (14.x line, shipped August 24, 2024) and NES v12.22.13 (12.x line, shipped November 10, 2025), neither of which received an upstream fix before reaching End-of-Life.
  • Node.js NES also lists v16.20.3 (16.x line, shipped July 30, 2024), a later post-EOL cumulative build carrying the same fix already shipped upstream in 16.20.1.

Vulnerability Info

This Medium-severity vulnerability is found in the OpenSSL library that Node.js bundles and statically links at deps/openssl, in every Node.js release whose bundled OpenSSL predates 3.1.1, 3.0.9, or 1.1.1u.

When an application opts into X.509 policy-constraint checking, OpenSSL is supposed to validate the certificate policy OIDs asserted at every certificate in the chain, including the leaf (end-entity) certificate, and reject the chain if a required policy is not satisfied.

In the vulnerable implementation, an invalid or malformed certificate policy asserted specifically in the leaf certificate is silently dropped rather than rejected, and OpenSSL then treats the rest of the policy checks for that certificate as satisfied.

Note: Because policy processing is off by default, applications that never call X509_VERIFY_PARAM_set1_policies() or pass -policy are not exposed by this issue.

Mitigation

The Node.js 12.x, 14.x, 16.x, 17.x, 18.x, 19.x, and 20.x release lines are all past their support window and will not receive further upstream updates. Node.js 12.x reached End-of-Life on April 30, 2022; Node.js 14.x on April 30, 2023; Node.js 16.x on September 11, 2023; Node.js 17.x on June 1, 2022; Node.js 18.x on April 30, 2025; Node.js 19.x on June 1, 2023; and Node.js 20.x on April 30, 2026. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js LTS release (22.x or 24.x), both of which bundle an OpenSSL version that already includes this fix.
• Migrate affected applications away from the End-of-Life Node.js release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• David Benjamin from Google (reporter)
• Matt Caswell from the OpenSSL project (remediation developer)