CVE-2023-31124

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development. The official Node.js distributions do not link against a system DNS resolver library: they compile and ship their own copy of c-ares inside the runtime, under deps/cares, and the asynchronous lookup functions in the built-in dns module are bindings over that bundled copy.

A use-of-insufficiently-random-values vulnerability (CVE-2023-31124) has been identified in the c-ares library bundled by Node.js. When c-ares is cross-compiled using the autotools build system (for example, cross-compiling for aarch64 Android), the build fails to set the CARES_RANDOM_FILE variable. Without it, c-ares silently downgrades to seeding its random number generation with the C library's rand() function instead of a cryptographically secure source, letting an attacker take advantage of the resulting lack of entropy.

This issue affects Node.js 12.x and 14.x in their entirety, and Node.js 16.x before 16.20.1, 18.x before 18.16.1, and 20.x before 20.3.1, whichever Node.js release lines bundle a c-ares version earlier than 1.19.1, the version that fixed this alongside three related c-ares issues (see Vulnerability Info).

Details

Module Info

• Product: Node.js
• Affected packages: Node.js runtime, which vendors the c-ares asynchronous resolver library under deps/cares and statically links it into the published node binary
• Affected versions: Node.js 12.x (all versions, <=12.22.12); Node.js 14.x (all versions, <=14.21.3); Node.js 16.x <16.20.1; Node.js 18.x <18.16.1; Node.js 20.x <20.3.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Official Node.js distributions (not published to a package registry)
• Fixed in: Node.js NES 12.22.13 (shipped November 10, 2025) and 14.21.4 (shipped August 24, 2024); the fix shipped upstream directly from the Node.js project in 16.20.1, 18.16.1, and 20.3.1 on June 20, 2023 while those lines were still actively supported

Vulnerability Info

This Low-severity vulnerability is found in the c-ares library bundled inside the Node.js runtime, in every published Node.js version that ships a c-ares version older than 1.19.1. c-ares is built via either autotools (the traditional Unix build path) or CMake; the autotools path is responsible for probing the target platform and setting CARES_RANDOM_FILE to point at a source of OS-provided entropy (typically /dev/urandom).

When autotools cross-compiles c-ares (the scenario the upstream advisory specifically calls out is cross-compiling for aarch64 Android), that detection step does not run correctly and CARES_RANDOM_FILE is left unset. c-ares then falls back to seeding pseudo-random output from the non-cryptographic rand() function rather than a CSPRNG, per CWE-330: Use of Insufficiently Random Values. Anywhere Node.js relies on that randomness for DNS-related operations in a cross-compiled build, the weaker entropy source applies.

c-ares 1.19.1 (May 22, 2023) fixed this along with three related, separately-tracked issues found in the same security-focused release: CVE-2023-31130 (buffer underflow in ares_inet_net_pton()), CVE-2023-31147 (insufficiently random DNS query IDs), and CVE-2023-32067 (denial of service from 0-byte UDP payloads). Node.js shipped all four fixes together on June 20, 2023 for its then-supported 16.x, 18.x, and 20.x lines; see that release's security release announcement.

Note: the GitHub Security Advisory for this issue states a workaround exists for builds that cannot immediately upgrade: switching from the autotools build system to CMake, which sets CARES_RANDOM_FILE correctly.

Mitigation

The Node.js 12.x, 14.x, 16.x, 18.x, and 20.x release lines are all past their support window and will not receive further upstream updates. Node.js 12.x reached End-of-Life on April 30, 2022; Node.js 14.x on April 30, 2023; Node.js 16.x on September 11, 2023; Node.js 18.x on April 30, 2025; and Node.js 20.x on April 30, 2026. For more information see Node.js's release schedule.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js LTS release (22.x or 24.x), all of which bundle a c-ares version well past 1.19.1.
• Migrate affected applications away from the End-of-Life Node.js release line(s).
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• David Gstir from X41 D-SEC GmbH (finder)
• Hannes Moesl from X41 D-SEC GmbH (finder)
• Audit funded by the Open Source Technology Improvement Fund (OSTIF)