CVE-2023-4807

Overview

Node.js is a JavaScript runtime built on the V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development. The official Node.js distributions do not link against a system cryptography library: they compile and ship their own copy of OpenSSL inside the runtime, and the built-in crypto module is a binding over that bundled copy.

A cryptographic weakness (CVE-2023-4807) has been identified in the POLY1305 message authentication code implementation inside the OpenSSL version that Node.js bundles at deps/openssl. On Windows 64-bit systems whose processor supports the AVX512-IFMA instruction set, the vulnerable code path fails to preserve the non-volatile XMM registers when processing more than 64 bytes of data, zeroing them instead of restoring their prior values. This can corrupt the internal state of the calling application. OpenSSL's own assessment is that an attacker who can influence when POLY1305 (used by the CHACHA20-POLY1305 AEAD cipher, a TLS 1.2/1.3 cipher suite) runs could trigger incorrect results or a crash, but cannot inject an arbitrary chosen value into those registers — which is why OpenSSL itself rates this issue Low even though the published CVSS v3.1 score is High.

This issue affects Node.js only on Windows 64-bit builds running on AVX512-IFMA-capable processors, and only where the affected OpenSSL version is bundled.

Details

Module Info

• Product: Node.js
• Affected packages: node (the runtime that bundles OpenSSL under deps/openssl and statically links it into the published node binary)
• Package manager: Official Node.js distributions (not published to a package registry)
• Affected versions:
  • >=12.0.0 <=12.22.12 (Node.js 12.x, entire line)
  • >=14.0.0 <=14.21.3 (Node.js 14.x, entire line)
  • >=16.0.0 <=16.20.2 (Node.js 16.x, entire line)
  • >=17.0.0 <=17.9.1 (Node.js 17.x, entire line)
  • >=18.0.0 <18.19.0
  • >=19.0.0 <=19.9.0 (Node.js 19.x, entire remaining line)
  • >=20.0.0 <20.10.0
• Per-line detail:
  • Node.js 12.x: last release bundled OpenSSL 1.1.1n, within the affected 1.1.1–1.1.1v range; reached End-of-Life 2022-04-30, before the September 8, 2023 OpenSSL advisory, so no upstream fix was ever shipped.
  • Node.js 14.x: last release bundled 1.1.1t; EOL 2023-04-30, before the advisory; no upstream fix.
  • Node.js 16.x: last release bundled 1.1.1v+quic, itself inside the affected range; EOL 2023-09-11, three days after this advisory, so no upstream fix was ever shipped.
  • Node.js 17.x: last release bundled OpenSSL 3.0.3+quic, within the affected 3.0.0–3.0.10 range; EOL 2022-06-01, long before the advisory.
  • Node.js 18.x: fixed upstream in 18.19.0, released 2023-11-29, which bundles OpenSSL 3.0.12+quic1, past the 3.0.11 fix point.
  • Node.js 19.x: stayed on OpenSSL 3.0.8+quic through its final release; non-LTS, EOL 2023-06-01, before the advisory.
  • Node.js 20.x: fixed upstream in 20.10.0, released 2023-11-22, which bundles OpenSSL 3.0.12+quic1.
  • Node.js 22.x and 24.x are not affected: both lines' first releases already bundled an OpenSSL version past the fix point.
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Fixed in: Node.js NES v12.22.13, v14.21.4, v16.20.3; upstream Node.js 18.19.0 and 20.10.0

Vulnerability Info

This High-severity vulnerability (per the published CVSS v3.1 score of 7.8; OpenSSL's own advisory rates the underlying issue Low) is found in the POLY1305 message authentication code implementation inside the OpenSSL copy that Node.js bundles. POLY1305 is normally expected to compute a MAC over input data without disturbing any state outside the cryptographic operation itself; callers rely on the processor's non-volatile (callee-saved) XMM registers being restored to their original values after the call returns.

On Windows 64-bit systems with AVX512-IFMA support, the vulnerable code path instead zeroes those registers for inputs longer than 64 bytes rather than restoring them, corrupting the calling application's floating-point/vector register state. The primary real-world trigger is the CHACHA20-POLY1305 AEAD cipher used in TLS 1.2 and TLS 1.3 connections.

Note: the OpenSSL FIPS provider is not affected, and disabling AVX512-IFMA via the OPENSSL_ia32cap environment variable is available as a workaround for builds that cannot immediately update.

Note: the Node.js 12.x, 14.x, 16.x, 17.x, 18.x, 19.x and 20.x release lines are all now past their support window. No NES fix path exists for the 17.x or 19.x lines — both are non-LTS lines with no NES product.

Mitigation

The Node.js 12.x, 14.x, 16.x, 17.x, 18.x, 19.x, and 20.x release lines are all past their support window and will not receive further upstream updates. Node.js 12.x reached End-of-Life on April 30, 2022; Node.js 14.x on April 30, 2023; Node.js 16.x on September 11, 2023; Node.js 17.x on June 1, 2022; Node.js 18.x on April 30, 2025; Node.js 19.x on June 1, 2023; and Node.js 20.x on April 30, 2026. For more information see Node.js releases.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js LTS release (22.x or 24.x), both of which bundle an OpenSSL version well past this fix.
• Migrate affected applications away from the End-of-Life Node.js release line(s).
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• Zach Wilson from Nvidia (finder, upstream OpenSSL report)
• Bernd Edlinger (finder and remediation developer, upstream OpenSSL report)