CVE-2023-39332

score

<0.1

cvss

9.8

epss

2.2%

published

2023-10-18

kev added

—

first seen

2026-10-21

Node.js `node:fs` functions accept paths as strings or `Uint8Array` objects. While string and Buffer paths are protected against traversal (see CVE-2023-30584 and CVE-2023-32004), non-Buffer `Uint8Array` paths are not, potentially allowing path traversal, exploit requires attacker to supply malicious `Uint8Array` path.