CVE-2023-45853

Overview

Node.js is an asynchronous, event-driven JavaScript runtime designed for building scalable network applications. Rather than relying on a system compression library, the Node.js source tree carries its own copy of zlib at deps/zlib, taken from Chromium's maintained fork. That copy includes the zlib contrib/minizip directory, a small ZIP archive reader and writer that the zlib authors describe as an unsupported, user-contributed add-on rather than part of zlib proper.

An integer overflow vulnerability (CVE-2023-45853) has been identified in the MiniZip code included in the zlib copy that Node.js bundles. When MiniZip adds a new entry to a ZIP archive, it is supposed to store the entry's filename, comment and extra field in 16-bit header fields. However, it never checked those lengths, so a very long filename, comment or extra field could overflow the size it computes for the central directory header and lead to a heap-based buffer overflow when the header is written.

This behaviour maps to CWE-190 (Integer Overflow or Wraparound), where an arithmetic result grows past what its type can hold and wraps to a smaller value that later code trusts. In MiniZip, the summed header length wraps, the buffer allocated for the central directory header is too small, and the subsequent copy writes past it, which can corrupt memory and potentially allow code execution or a crash.

Exploitation requires a program that uses MiniZip to create ZIP archives and lets an attacker control the name, comment or extra-field data of an entry being written. The official node binary does not compile MiniZip: the Node.js build of deps/zlib links only the core zlib sources, and HeroDevs' own VEX statements mark NES Node.js builds as not affected because the vulnerable code is not in the execute path. The exposure is therefore to software that builds MiniZip from the Node.js source tree, not to the node:zlib module. The vulnerable MiniZip source is present in every Node.js release line up to 16.x, in 17.x and 19.x, and in 18.x and 20.x before the versions listed above.

Details

Module Info

• Product: Node.js
• Affected packages: node (bundles zlib, including contrib/minizip, under deps/zlib)
• Affected versions: <=16.20.2 >=17.0.0 <=17.9.1 >=18.0.0 <18.19.0 >=19.0.0 <=19.9.0 >=20.0.0 <20.7.0
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable; Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package
• Fixed in: Node.js 20.7.0 (September 18, 2023) and 18.19.0 (November 29, 2023), whose routine zlib dependency updates pulled in Chromium's MiniZip length checks while those lines were still supported; Node.js NES v16.20.3 (16.x line, shipped July 30, 2024), which lists this CVE among its dependency security fixes after 16.x reached End-of-Life

Vulnerability Info

This High-severity vulnerability is found in zipOpenNewFileInZip4_64() in the MiniZip sources (contrib/minizip/zip.c) inside the zlib copy that Node.js bundles at deps/zlib. The CISA ADP assigns a CVSS v3.1 score of 8.8; NVD's own analysis scores it 9.8.

MiniZip writes each entry's filename, comment and extra-field lengths into 16-bit fields of the local and central directory headers, so values longer than 65,535 bytes cannot be represented. The vulnerable code accepted any length, added them together to size the central directory header, and copied the data in. With large enough inputs the size calculation overflows, the allocated buffer is undersized, and the copy overruns the heap. The fix rejects any filename, comment or extra field longer than 0xffff bytes before the header is built. See the zlib fix commit for the exact change; it was first patched in Chromium, then upstream in zlib 1.3.1.

An attacker would need to feed attacker-controlled entry names, comments or extra fields into an application that writes ZIP archives through MiniZip, for example a service that zips up user-named uploads.

Note: Because the Node.js build compiles only the core zlib library and not MiniZip, applications that use node:zlib, or ordinary JavaScript ZIP packages, do not reach the vulnerable function through Node.js itself.

Mitigation

The Node.js 16.x, 17.x and 19.x release lines never received an upstream update containing the fix, and the 18.x and 20.x lines are now past their support window as well. Node.js 16.x reached End-of-Life on September 11, 2023; Node.js 17.x on June 1, 2022; Node.js 18.x on April 30, 2025; Node.js 19.x on June 1, 2023; and Node.js 20.x on April 30, 2026. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js LTS release (22.x or 24.x), both of which bundle a zlib copy that already includes this fix.
• Migrate affected applications away from the End-of-Life Node.js release lines, and do not build MiniZip from an unpatched deps/zlib tree.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• Reported to the Chromium project (crbug.com/1470539), per the zlib fix commit; the CVE record names no individual reporter