CVE-2023-32559

score

<0.1

cvss

7.5

epss

1.8%

published

2023-08-24

kev added

—

first seen

2026-10-21

Node.js versions 16.x, 18.x, and 20.x contain a privilege escalation caused by the use of deprecated `process.binding()` API in the experimental policy mechanism, letting attackers bypass policy restrictions and execute arbitrary code outside `policy.json`, exploit requires attacker to run code with Node.js.