CVE-2023-31130

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development. The official Node.js distributions do not link against a system DNS resolver library: they compile and ship their own copy of c-ares inside the runtime, under deps/cares, and the asynchronous lookup functions in the built-in dns module are bindings over that bundled copy.

A buffer underflow vulnerability (CVE-2023-31130) has been identified in the c-ares library bundled by Node.js, in the ares_inet_net_pton() function. Certain crafted IPv6 address strings, such as the upstream advisory's example "0::00:00:00/2", cause the function to read or write before the start of its buffer.

This issue affects Node.js 12.x and 14.x in their entirety, and Node.js 16.x before 16.20.1, 18.x before 18.16.1, and 20.x before 20.3.1, whichever Node.js release lines bundle a c-ares version earlier than 1.19.1, the version that fixed this alongside three related c-ares issues (see Vulnerability Info).

Details

Module Info

• Product: Node.js
• Affected packages: Node.js runtime, which vendors the c-ares asynchronous resolver library under deps/cares and statically links it into the published node binary
• Affected versions: Node.js 12.x (all versions, <=12.22.12); Node.js 14.x (all versions, <=14.21.3); Node.js 16.x <16.20.1; Node.js 18.x <18.16.1; Node.js 20.x <20.3.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Official Node.js distributions (not published to a package registry)
• Fixed in: Node.js NES 12.22.13 (shipped November 10, 2025) and 14.21.4 (shipped August 24, 2024); the fix shipped upstream directly from the Node.js project in 16.20.1, 18.16.1, and 20.3.1 on June 20, 2023 while those lines were still actively supported

Vulnerability Info

This vulnerability is found in the c-ares library bundled inside the Node.js runtime, in every published Node.js version that ships a c-ares version older than 1.19.1. ares_inet_net_pton() parses a text IPv6 or IPv4 address plus a prefix-length suffix (CIDR notation) into its binary form; within Node.js itself, this function is reached internally through ares_set_sortlist(), which lets an application configure a preferred order of resolved addresses.

Certain malformed IPv6 inputs, such as "0::00:00:00/2", drive the parser's internal bit-counting logic past the start of its working buffer, an out-of-bounds read/write described in CWE-124: Buffer Underwrite ('Buffer Underflow'). Because the c-ares-internal call path requires an application or its administrator to have configured a sortlist, the practical Node.js exposure is generally lower than for code that calls ares_inet_net_pton() directly with attacker-controlled input.

Note: NVD's own CVSS assessment for this CVE (6.4, Medium) differs from the score published in the CNA/GHSA record (4.1, Medium); both bands are Medium, but the underlying impact metrics and CWE assignment differ.

c-ares 1.19.1 (May 22, 2023) fixed this along with three related, separately-tracked issues found in the same security-focused release: CVE-2023-31124 (insufficient entropy in cross-compiled builds), CVE-2023-31147 (insufficiently random DNS query IDs), and CVE-2023-32067 (denial of service from 0-byte UDP payloads). Node.js shipped all four fixes together on June 20, 2023 for its then-supported 16.x, 18.x, and 20.x lines; see that release's security release announcement.

Mitigation

The Node.js 12.x, 14.x, 16.x, 18.x, and 20.x release lines are all past their support window and will not receive further upstream updates. Node.js 12.x reached End-of-Life on April 30, 2022; Node.js 14.x on April 30, 2023; Node.js 16.x on September 11, 2023; Node.js 18.x on April 30, 2025; and Node.js 20.x on April 30, 2026. For more information see Node.js's release schedule.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js LTS release (22.x or 24.x), all of which bundle a c-ares version well past 1.19.1.
• Migrate affected applications away from the End-of-Life Node.js release line(s).
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• Hannes Moesl from X41 D-SEC GmbH (finder)
• Audit funded by the Open Source Technology Improvement Fund (OSTIF)