CVE-2023-30590The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the functi…
Updated under an hour ago ()
Does this affect you?
It affects NodeJS Node and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.
- CVSS
- 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- hackerone
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
NodeJS Node nodejs:node (from the name) | from 4.0 before 4.*; from 5.0 before 5.*; from 6.0 before 6.*; from 7.0 before 7.*; from 8.0 before 8.*; from 9.0 before 9.*; from 10.0 before 10.*; from 11.0 before 11.*; and 9 more ranges | CNA record |
nodejs node.js nodejs:node.js | from 16.0.0 before 16.20.1; from 18.0.0 before 18.16.1; from 20.0.0 before 20.3.1 | NVD |
References
- https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
- https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.