CVE-2023-30590 [High] | Security Vulnerability in Node.js

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-21	1.22%	1.46%	+0.25%
2	2026-06-15	0.95%	1.22%	+0.26%
3	2026-03-25	—	0.95%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-21

1.22%

1.46%

+0.25%

2026-06-15

0.95%

1.22%

+0.26%

2026-03-25

—

0.95%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.5	3.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:N) Service keeps running; no real outage angle.	3.9	3.6	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.5

3.1

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N): Doesn’t really leak secrets in a meaningful way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N): Service keeps running; no real outage angle.

3.9

3.6

[email protected]

OS Trackers for CVE-2023-30590

vendor	priority	summary	link
`alpine`	—	CVE-2023-30590: 1 source package rows (nodejs); 32 state rows across 5 repos (3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 0, open 32.	https://security.alpinelinux.org/vuln/CVE-2023-30590
`debian`	not yet assigned	CVE-2023-30590 not yet assigned priority: Debian including 1 source packages (nodejs), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2023-30590
`gentoo`	low	CVE-2023-30590: 1 GLSA(s) (202405-29), 1 atom(s) (net-libs/nodejs); latest impact low.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2023-30590
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2023-30590
`suse`	medium	CVE-2023-30590 severity moderate: SUSE including 58 source package names (16-18.3:nodejs16-16.20.1-150400.3.21.1, 16-18.3:npm16-16.20.1-150400.3.21.1, …), 217 product×package rows across 22 product lines (Container bci/nodejs, SUSE Enterprise Storage 7, … (22 product lines)): Fixed 216, Known Not Affected 1.	https://www.suse.com/security/cve/CVE-2023-30590/
`ubuntu`	medium	CVE-2023-30590 medium priority: Ubuntu including 1 source packages (nodejs), 10 status rows across 10 suites (bionic, focal, jammy, kinetic, lunar, mantic, noble, trusty, upstream, xenial): released 6, ignored 2, needs-triage 1, not-affected 1.	https://ubuntu.com/security/CVE-2023-30590

Affected software / configurations for CVE-2023-30590

Vendor	Product	Version	Raw CPE
nodejs	node.js	>= 16.0.0, < 16.20.1	cpe:2.3:a:nodejs:node.js::::::::
nodejs	node.js	>= 18.0.0, < 18.16.1	cpe:2.3:a:nodejs:node.js::::::::
nodejs	node.js	>= 20.0.0, < 20.3.1	cpe:2.3:a:nodejs:node.js::::::::

References for CVE-2023-30590

URL	Tags
https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases	Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html
https://security.netapp.com/advisory/ntap-20241101-0011/

URL

CVE-2023-30590

Exploit prediction scoring system (EPSS) score for CVE-2023-30590

Common vulnerability scoring system (CVSS) metrics for CVE-2023-30590

Weakness enumeration for CVE-2023-30590

OS Trackers for CVE-2023-30590

Affected software / configurations for CVE-2023-30590

References for CVE-2023-30590