CVE-2023-0466

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development. The official Node.js distributions do not link against a system cryptography library: they compile and ship their own copy of OpenSSL inside the runtime, at deps/openssl in the Node.js source tree, and the built-in crypto and tls modules are bindings over that bundled copy. A vulnerability in the bundled OpenSSL therefore affects Node.js directly, whether or not Node.js itself contains any new code.

A certificate-policy-check vulnerability (CVE-2023-0466) has been identified in the OpenSSL library bundled with Node.js: the X509_VERIFY_PARAM_add0_policy() function is documented to implicitly enable the certificate policy check during verification, but its implementation does not actually enable that check.

Per OWASP, improper certificate validation occurs “when a certificate is not properly validated, which can allow an attacker to impersonate a trusted entity.”

An application (or an npm dependency of one) that calls X509_VERIFY_PARAM_add0_policy() believing that call alone turns on policy checking will continue to accept certificates with invalid or incorrect policies, because the check is never actually enabled; OpenSSL decided to keep this existing behavior rather than risk breaking deployments by suddenly enabling the check. Policy processing is disabled by default in OpenSSL and is not commonly used by applications. This issue affects the Node.js 12.x, 14.x, 16.x, 17.x, 18.x, 19.x, and 20.x release lines up to the versions listed below; Node.js 22.x and 24.x never bundled a vulnerable OpenSSL version and are not affected.

Details

Module Info

• Product: Node.js
• Affected packages: node (bundles OpenSSL under deps/openssl)
• Affected versions:
  • >=12.0.0 <=12.22.12
  • >=14.0.0 <=14.21.3
  • >=16.0.0 <16.20.1
  • >=17.0.0 <=17.9.1
  • >=18.0.0 <18.16.1
  • >=19.0.0 <=19.9.0
  • >=20.0.0 <20.3.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable — Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package.
• Fixed in:
  
  • Upstream Node.js 16.20.1, 18.16.1, and 20.3.1, released while those lines were still in active support.
  • Node.js NES also carries this fix under v16.20.3 (16.x line, shipped July 30, 2024, as part of NES's post-EOL continuation of the already-fixed 16.x line), v14.21.4 (14.x line, shipped August 24, 2024), and v12.22.13 (12.x line, shipped November 10, 2025); the 14.x and 12.x lines never received an upstream fix before reaching End-of-Life.

Vulnerability Info

This Medium-severity vulnerability is found in the OpenSSL library that Node.js bundles and statically links at deps/openssl, in every Node.js release whose bundled OpenSSL predates 3.1.1, 3.0.9, or 1.1.1u.

X509_VERIFY_PARAM_add0_policy() adds a policy OID to the set of acceptable policies used during X.509 verification, and its documentation states that calling it is sufficient, on its own, to enable the certificate policy check.

In the vulnerable implementation, calling X509_VERIFY_PARAM_add0_policy() adds the policy but does not set the internal flag that actually turns policy checking on, so verification proceeds as if no policy check had been requested at all.

Note: OpenSSL did not change X509_VERIFY_PARAM_add0_policy()'s behavior; it only corrected the documentation. Applications that require OpenSSL to perform certificate policy checks need to call X509_VERIFY_PARAM_set1_policies() instead, or explicitly set the X509_V_FLAG_POLICY_CHECK flag via X509_VERIFY_PARAM_set_flags().

Mitigation

The Node.js 12.x, 14.x, 16.x, 17.x, 18.x, 19.x, and 20.x release lines are all past their support window and will not receive further upstream updates. Node.js 12.x reached End-of-Life on April 30, 2022; Node.js 14.x on April 30, 2023; Node.js 16.x on September 11, 2023; Node.js 17.x on June 1, 2022; Node.js 18.x on April 30, 2025; Node.js 19.x on June 1, 2023; and Node.js 20.x on April 30, 2026. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js LTS release (22.x or 24.x), both of which bundle an OpenSSL version that already includes this fix.
• Migrate affected applications away from the End-of-Life Node.js release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• David Benjamin from Google (reporter)
• Tomas Mraz from the OpenSSL project (remediation developer)