CVE-2023-32067

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development. The official Node.js distributions do not link against a system DNS resolver library: they compile and ship their own copy of c-ares inside the runtime, under deps/cares, and the asynchronous lookup functions in the built-in dns module are bindings over that bundled copy.

A denial-of-service vulnerability (CVE-2023-32067) has been identified in the c-ares library bundled by Node.js. An attacker able to send a target resolver a spoofed, malformed UDP packet with a payload length of 0 can trigger the resolver to misinterpret that zero-length packet as a graceful shutdown of the connection, halting DNS resolution.

This issue affects Node.js 12.x and 14.x in their entirety, and Node.js 16.x before 16.20.1, 18.x before 18.16.1, and 20.x before 20.3.1, whichever Node.js release lines bundle a c-ares version earlier than 1.19.1, the version that fixed this alongside three related c-ares issues (see Vulnerability Info).

Details

Module Info

• Product: Node.js
• Affected packages: Node.js runtime, which vendors the c-ares asynchronous resolver library under deps/cares and statically links it into the published node binary
• Affected versions: Node.js 12.x (all versions, <=12.22.12); Node.js 14.x (all versions, <=14.21.3); Node.js 16.x <16.20.1; Node.js 18.x <18.16.1; Node.js 20.x <20.3.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Official Node.js distributions (not published to a package registry)
• Fixed in: Node.js NES 12.22.13 (shipped November 10, 2025) and 14.21.4 (shipped August 24, 2024); the fix shipped upstream directly from the Node.js project in 16.20.1, 18.16.1, and 20.3.1 on June 20, 2023 while those lines were still actively supported

Vulnerability Info

This High-severity vulnerability is found in the c-ares library bundled inside the Node.js runtime, in every published Node.js version that ships a c-ares version older than 1.19.1. When c-ares sends a DNS query over UDP, it expects a response packet with an actual DNS message payload; the resolver's socket-handling logic is also responsible for detecting when the far end has closed the connection.

An attacker who can address a UDP packet to the target resolver, without needing to spoof a valid DNS response, guess a query ID, or otherwise be on-path, can send a UDP datagram with a payload length of exactly 0 bytes. c-ares' connection-handling code erroneously treats that zero-length read the same way it would treat a TCP connection being gracefully closed, and the affected resolution channel stops functioning. Repeated forged packets can be used to disrupt a target's DNS resolution on an ongoing basis, denying availability without requiring any privileges or user interaction.

c-ares 1.19.1 (May 22, 2023) fixed this along with three related, separately-tracked issues found in the same security-focused release: CVE-2023-31124 (insufficient entropy in cross-compiled builds), CVE-2023-31130 (buffer underflow in ares_inet_net_pton()), and CVE-2023-31147 (insufficiently random DNS query IDs). Unlike those three, which came out of an X41 D-SEC/OSTIF-funded audit, this issue was reported independently. Node.js shipped all four fixes together on June 20, 2023 for its then-supported 16.x, 18.x, and 20.x lines; see that release's security release announcement.

Mitigation

The Node.js 12.x, 14.x, 16.x, 18.x, and 20.x release lines are all past their support window and will not receive further upstream updates. Node.js 12.x reached End-of-Life on April 30, 2022; Node.js 14.x on April 30, 2023; Node.js 16.x on September 11, 2023; Node.js 18.x on April 30, 2025; and Node.js 20.x on April 30, 2026. For more information see Node.js's release schedule.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js LTS release (22.x or 24.x), all of which bundle a c-ares version well past 1.19.1.
• Migrate affected applications away from the End-of-Life Node.js release line(s).
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• Xiang Li from the Network and Information Security Laboratory, Tsinghua University (finder)