CVE-2023-31147

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development. The official Node.js distributions do not link against a system DNS resolver library: they compile and ship their own copy of c-ares inside the runtime, under deps/cares, and the asynchronous lookup functions in the built-in dns module are bindings over that bundled copy.

A use-of-insufficiently-random-values vulnerability (CVE-2023-31147) has been identified in the c-ares library bundled by Node.js. When the OS-provided cryptographically secure sources c-ares prefers, /dev/urandom and Windows' RtlGenRandom(), are unavailable, c-ares falls back to generating the 16-bit transaction ID used to match a DNS query to its response using the non-cryptographic rand() function, further weakened by a non-standards-compliant RC4 implementation used to mix its output.

This issue affects Node.js 12.x and 14.x in their entirety, and Node.js 16.x before 16.20.1, 18.x before 18.16.1, and 20.x before 20.3.1, whichever Node.js release lines bundle a c-ares version earlier than 1.19.1, the version that fixed this alongside three related c-ares issues (see Vulnerability Info).

Details

Module Info

• Product: Node.js
• Affected packages: Node.js runtime, which vendors the c-ares asynchronous resolver library under deps/cares and statically links it into the published node binary
• Affected versions: Node.js 12.x (all versions, <=12.22.12); Node.js 14.x (all versions, <=14.21.3); Node.js 16.x <16.20.1; Node.js 18.x <18.16.1; Node.js 20.x <20.3.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Official Node.js distributions (not published to a package registry)
• Fixed in: Node.js NES 12.22.13 (shipped November 10, 2025) and 14.21.4 (shipped August 24, 2024); the fix shipped upstream directly from the Node.js project in 16.20.1, 18.16.1, and 20.3.1 on June 20, 2023 while those lines were still actively supported

Vulnerability Info

This vulnerability is found in the c-ares library bundled inside the Node.js runtime, in every published Node.js version that ships a c-ares version older than 1.19.1. Every outgoing DNS query c-ares sends carries a query ID that the resolver uses to match an incoming UDP response back to the request that triggered it; a resolver is supposed to reject any response whose ID does not match, which is the main defense against off-path DNS response spoofing described by CWE-330: Use of Insufficiently Random Values.

c-ares generates that ID from rand(), which is neither a cryptographically secure PRNG nor reseeded with srand(), when the platform's own secure random sources are unavailable; the advisory further notes the RC4-based mixing step applied to that output is itself implemented incorrectly. Predictable query IDs make it easier for an off-path attacker to guess a valid ID and race a forged DNS response ahead of the legitimate one, enabling response spoofing or cache poisoning against affected resolvers.

c-ares 1.19.1 (May 22, 2023) fixed this along with three related, separately-tracked issues found in the same security-focused release: CVE-2023-31124 (insufficient entropy in cross-compiled builds), CVE-2023-31130 (buffer underflow in ares_inet_net_pton()), and CVE-2023-32067 (denial of service from 0-byte UDP payloads). Node.js shipped all four fixes together on June 20, 2023 for its then-supported 16.x, 18.x, and 20.x lines; see that release's security release announcement.

Mitigation

The Node.js 12.x, 14.x, 16.x, 18.x, and 20.x release lines are all past their support window and will not receive further upstream updates. Node.js 12.x reached End-of-Life on April 30, 2022; Node.js 14.x on April 30, 2023; Node.js 16.x on September 11, 2023; Node.js 18.x on April 30, 2025; and Node.js 20.x on April 30, 2026. For more information see Node.js's release schedule.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js LTS release (22.x or 24.x), all of which bundle a c-ares version well past 1.19.1.
• Migrate affected applications away from the End-of-Life Node.js release line(s).
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• David Gstir from X41 D-SEC GmbH (finder)
• Hannes Moesl from X41 D-SEC GmbH (finder)
• Audit funded by the Open Source Technology Improvement Fund (OSTIF)