CVE-2024-4761

Overview

Node.js is an asynchronous, event-driven JavaScript runtime designed for building scalable network applications. Node.js runs JavaScript and WebAssembly on Google's V8 engine, which it vendors in full at deps/v8 in the Node.js source tree and compiles into the node binary. A vulnerability in V8 can therefore reach Node.js, but only where the vulnerable V8 code is present and enabled in that Node.js build.

An out-of-bounds write vulnerability (CVE-2024-4761) has been identified in the V8 engine bundled with Node.js. V8 has an internal fast path that copies data properties from one object to another, which Object.assign() and object spread rely on. When the source object stores its properties in dictionary mode and the target uses fast properties, V8 converts the target to dictionary mode first. However, V8 assumed every such target was an ordinary JavaScript object. A WebAssembly GC struct or array is not, so converting it lets V8 write outside the memory that belongs to it. Google reported this flaw as exploited in the wild against Chrome.

This behaviour maps to CWE-787 (Out-of-bounds Write), where software writes data past the end, or before the beginning, of the buffer it intends to use. In V8, the object being converted has a different layout from what the conversion code expects, so the write lands on memory belonging to something else on the V8 heap. Corrupting V8 heap memory this way is a common first step toward arbitrary code execution.

Exploitation requires running attacker-supplied JavaScript and WebAssembly that creates WebAssembly GC objects. In Chrome, that is a crafted web page. In Node.js, it means an application that executes untrusted code, such as a sandboxing or plugin service. WebAssembly GC is enabled by default only from Node.js 22.0.0. In Node.js 16.x through 20.x it is behind the experimental --experimental-wasm-gc flag, and in 21.x behind V8's staging flags, so those lines are exposed only when such a flag is turned on. The vulnerable code is present from Node.js 16.0.0 through 21.x and in 22.x before 22.3.0.

Details

Module Info

• Product: Node.js
• Affected packages: node (bundles V8 under deps/v8)
• Affected versions: >=16.0.0 <=16.20.2 >=17.0.0 <=17.9.1 >=18.0.0 <=18.20.8 >=19.0.0 <=19.9.0 >=20.0.0 <=20.20.2 >=21.0.0 <=21.7.3 >=22.0.0 <22.3.0
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable; Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package
• Fixed in: Node.js 22.3.0 (released June 11, 2024), whose V8 12.4 patch updates include the fix; no upstream release of the 16.x through 21.x lines ever received it; Node.js NES v18.20.5 (18.x line, shipped September 20, 2024) and v20.18.4 (20.x line, shipped February 26, 2025)

Vulnerability Info

This High-severity vulnerability is found in JSReceiver::SetOrCopyDataProperties() in V8 (src/objects/js-objects.cc), the copy routine behind Object.assign() and object spread in the V8 engine bundled with Node.js. NVD assigns a CVSS v3.1 score of 8.8.

Before copying, the routine checks whether the source object is in dictionary mode and the target object has fast properties. If so, it converts the target to dictionary mode so that copying cannot overflow its descriptor table. The vulnerable code applied that conversion to any target except a global proxy, assuming the target was an ordinary JavaScript object. WebAssembly GC structs and arrays are V8 receivers with a different internal layout. Normalizing one treats its memory as though it had the layout of a regular object, which produces an out-of-bounds write. The fix converts the target only when it is a real JavaScript object. See the V8 fix commit for the exact change.

An attacker would need to get JavaScript and WebAssembly of their choosing executed by the application, then copy dictionary-mode properties onto a WebAssembly GC object. Google stated that an exploit for this issue existed in the wild against Chrome, and CISA added it to its Known Exploited Vulnerabilities catalog on May 16, 2024.

Note: Applications that run only their own trusted code are not exposed. On Node.js 16.x through 21.x, an application is not exposed unless WebAssembly GC has been enabled with an experimental or staging V8 flag.

Mitigation

The Node.js 16.x, 17.x, 18.x, 19.x, 20.x and 21.x release lines are all past their support window and will not receive further upstream updates. Node.js 16.x reached End-of-Life on September 11, 2023; Node.js 17.x on June 1, 2022; Node.js 18.x on April 30, 2025; Node.js 19.x on June 1, 2023; Node.js 20.x on April 30, 2026; and Node.js 21.x on June 1, 2024. Node.js 22.x is still supported and is fixed in 22.3.0 and later. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Node.js 22.3.0 or later on the 22.x line, or to Node.js 24.x, both of which include this fix.
• Migrate affected applications away from the End-of-Life Node.js release lines, and do not enable experimental WebAssembly GC flags on them.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• Anonymous (reporter), per Google's Chrome release notes of May 13, 2024