Medium severity5.3NVD Advisory· Published Sep 7, 2024· Updated Apr 15, 2026
CVE-2023-39333
CVE-2023-39333
Description
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.
This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the --experimental-wasm-modules command line option.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
27- osv-coords25 versionspkg:apk/chainguard/nodejs-16-docpkg:apk/wolfi/nodejs-16-docpkg:bitnami/nodepkg:bitnami/node-minpkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/npmpkg:rpm/opensuse/nodejs20&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nodejs-electron&distro=openSUSE%20Tumbleweedpkg:rpm/suse/nodejs16&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOSpkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4pkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/nodejs16&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/nodejs16&distro=SUSE%20Manager%20Server%204.2pkg:rpm/suse/nodejs18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/nodejs18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP4pkg:rpm/suse/nodejs18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP5
< 16.20.2-r15+ 24 more
- (no CPE)range: < 16.20.2-r15
- (no CPE)range: < 16.20.2-r15
- (no CPE)range: < 18.18.2
- (no CPE)range: < 18.18.2
- (no CPE)range: < 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
- (no CPE)range: < 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
- (no CPE)range: < 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
- (no CPE)range: < 1:18.18.2-2.module_el9.2.0+43+3ebc9e20
- (no CPE)range: < 3.0.1-1.module_el9.2.0+36+853e48f5
- (no CPE)range: < 2021.06-4.module_el9.1.0+13+d9a595ea
- (no CPE)range: < 2021.06-4.module_el9.1.0+13+d9a595ea
- (no CPE)range: < 1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20
- (no CPE)range: < 20.8.1-1.1
- (no CPE)range: < 25.9.1-2.1
- (no CPE)range: < 16.20.2-150300.7.30.1
- (no CPE)range: < 16.20.2-150300.7.30.1
- (no CPE)range: < 16.20.2-150300.7.30.1
- (no CPE)range: < 16.20.2-8.36.1
- (no CPE)range: < 16.20.2-150400.3.27.2
- (no CPE)range: < 16.20.2-150300.7.30.1
- (no CPE)range: < 16.20.2-150300.7.30.1
- (no CPE)range: < 16.20.2-150300.7.30.1
- (no CPE)range: < 18.18.2-8.15.1
- (no CPE)range: < 18.18.2-150400.9.15.1
- (no CPE)range: < 18.18.2-150400.9.15.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.