CVE-2024-4947

Overview

Node.js is an asynchronous, event-driven JavaScript runtime designed for building scalable network applications. Node.js runs JavaScript on Google's V8 engine, which it vendors in full at deps/v8 in the Node.js source tree and compiles into the node binary. V8 includes several just-in-time compilers. Maglev, the mid-tier optimizing compiler, is compiled into the official Node.js binaries and turned on by default starting with Node.js 22.0.0 on x64, arm and arm64.

A type confusion vulnerability (CVE-2024-4947) has been identified in the V8 engine bundled with Node.js. When V8's optimizing compilers plan a property access, they classify it by the kind of property involved. A store to an export of an ES module namespace object (the object produced by import * as ns) should never be optimized, because writing to a module namespace is always either an error or a no-op in JavaScript. However, V8 classified such stores as module-export accesses, and Maglev's store path treated that classification as an ordinary data field. Optimized code could then write to memory as if it held one kind of object when it held another, which an attacker can use to run arbitrary code inside the V8 process. Google reported this flaw as exploited in the wild against Chrome.

This behaviour maps to CWE-843 (Access of Resource Using Incompatible Type, or Type Confusion), where code accesses a resource using a type that is incompatible with the resource's actual type. In V8, the compiler emits a field store against a module export cell as though it were a regular object field. Type confusion in a JIT compiler is a well-known route to memory corruption and code execution.

Exploitation requires running attacker-supplied JavaScript that uses ES modules and gets hot enough for Maglev to optimize the offending store. In Chrome, that is a crafted web page. In Node.js, it means an application that executes untrusted code, such as a sandboxing or plugin service. The official Node.js 18.x through 21.x binaries carry the Maglev source in deps/v8 but are built without it unless --v8-enable-maglev is passed to configure. Only Node.js 22.0.0 through 22.2.0 ship with Maglev compiled in and enabled by default, which makes them the exposed official builds.

Details

Module Info

• Product: Node.js
• Affected packages: node (bundles V8 under deps/v8)
• Affected versions: >=18.0.0 <=18.20.8 >=19.0.0 <=19.9.0 >=20.0.0 <=20.20.2 >=21.0.0 <=21.7.3 >=22.0.0 <22.3.0
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable; Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package
• Fixed in: Node.js 22.3.0 (released June 11, 2024), whose V8 12.4 patch updates include the fix; no upstream release of the 18.x through 21.x lines ever received it; Node.js NES v18.20.5 (18.x line, shipped September 20, 2024) and v20.18.4 (20.x line, shipped February 26, 2025)

Vulnerability Info

This Critical-severity vulnerability is found in V8's property-access analysis (src/compiler/access-info.cc) and the store path of the Maglev compiler (src/maglev/maglev-graph-builder.cc) in the V8 engine bundled with Node.js. NVD assigns a CVSS v3.1 score of 9.6.

When V8 optimizes a property store, it is supposed to emit a direct field write only after confirming that the property is a plain data field or a setter. In the vulnerable code, the access analysis returned a module-export access for stores to a module namespace object. Maglev's store builder handled every non-setter access as a data field, checked only by a debug assertion that is compiled out of release builds, so it generated a field write against a module export cell. The fix makes the analysis refuse to optimize stores to module namespace exports and makes Maglev reject any unexpected access kind. See the V8 fix commit for the exact change.

An attacker would need to get JavaScript of their choosing executed by the application and drive a store to a module namespace export through Maglev-optimized code. Google stated that an exploit for this issue existed in the wild against Chrome, and CISA added it to its Known Exploited Vulnerabilities catalog on May 20, 2024.

Note: Applications that run only their own trusted code are not exposed. Official Node.js 18.x through 21.x binaries are not exposed through Maglev, because Maglev is not compiled into them.

Mitigation

The Node.js 18.x, 19.x, 20.x and 21.x release lines are all past their support window and will not receive further upstream updates. Node.js 18.x reached End-of-Life on April 30, 2025; Node.js 19.x on June 1, 2023; Node.js 20.x on April 30, 2026; and Node.js 21.x on June 1, 2024. Node.js 22.x is still supported and is fixed in 22.3.0 and later. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Node.js 22.3.0 or later on the 22.x line, or to Node.js 24.x, both of which include this fix.
• Migrate affected applications away from the End-of-Life Node.js release lines, and do not build them with --v8-enable-maglev.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• Vasily Berdnikov from Kaspersky (reporter)
• Boris Larin from Kaspersky (reporter)