CVE-2023-23919: Node.js Cryptographic DoS Vulnerability

CVE-2023-23919 Overview

A cryptographic vulnerability exists in Node.js that fails to properly clear the OpenSSL error stack after certain operations. This improper error handling can lead to false positive errors during subsequent cryptographic operations on the same thread, potentially enabling a denial of service condition against affected applications.

Critical Impact

Applications using Node.js cryptographic functions may experience service disruptions due to false positive errors triggered by uncleared OpenSSL error states, enabling denial of service attacks.

Affected Products

• Node.js versions prior to 19.2.0
• Node.js versions prior to 18.14.1 (LTS)
• Node.js versions prior to 16.19.1 (LTS)
• Node.js versions prior to 14.21.3 (LTS)

Discovery Timeline

• February 23, 2023 - CVE-2023-23919 published to NVD
• March 12, 2025 - Last updated in NVD database

Technical Details for CVE-2023-23919

Vulnerability Analysis

This vulnerability stems from improper handling of the OpenSSL error stack within Node.js cryptographic operations. When certain cryptographic functions execute, they may set entries on the OpenSSL error stack. Under normal circumstances, these error stack entries should be cleared after operations complete. However, the vulnerable versions of Node.js fail to consistently clear these error entries in some cases.

The impact manifests when subsequent cryptographic operations execute on the same thread and encounter the stale error stack entries. These leftover errors can cause valid cryptographic operations to fail with false positive error conditions, as the new operation interprets the residual error state as an indication of failure.

An attacker can exploit this behavior by crafting requests that trigger specific cryptographic operations designed to leave the error stack in a polluted state. When legitimate requests subsequently use the same thread for cryptographic functions, they encounter these false errors and fail, resulting in denial of service.

Root Cause

The root cause is classified under CWE-310 (Cryptographic Issues). The vulnerability arises from incomplete cleanup of the OpenSSL error stack after cryptographic operations. Node.js wraps OpenSSL functionality for its crypto module, and certain code paths fail to call ERR_clear_error() or equivalent cleanup functions after operations that may populate the error stack. This leaves residual error state that persists across operation boundaries.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can send specially crafted requests to a Node.js application that trigger cryptographic operations leaving the OpenSSL error stack in a dirty state. Because Node.js uses a thread pool for cryptographic operations, subsequent legitimate requests assigned to the same thread will encounter the polluted error state, causing their cryptographic operations to fail with spurious errors.

The attack is particularly effective against applications performing high volumes of cryptographic operations, as the probability of legitimate requests hitting affected threads increases with load. This can cascade into widespread service degradation or complete denial of service.

Detection Methods for CVE-2023-23919

Indicators of Compromise

• Unexpected cryptographic operation failures in application logs with OpenSSL error codes that don't match the actual operation being performed
• Intermittent failures in TLS handshakes, certificate validation, or encryption/decryption operations
• Error messages referencing OpenSSL error stack entries from operations that should have completed previously
• Increased rate of cryptographic-related exceptions under high traffic conditions

Detection Strategies

• Monitor application logs for cryptographic operation failures that exhibit intermittent or thread-correlated patterns
• Implement health checks that perform cryptographic operations and alert on unexpected failure rates
• Deploy application performance monitoring to detect degradation in crypto-heavy endpoints
• Audit Node.js version inventory across all production systems to identify vulnerable installations

Monitoring Recommendations

• Track the ratio of cryptographic operation successes to failures over time windows
• Alert on sudden increases in crypto-related errors, particularly when correlated with traffic spikes
• Monitor thread pool utilization alongside error rates to identify thread-correlation patterns
• Implement distributed tracing to correlate failed operations with potential attack traffic

How to Mitigate CVE-2023-23919

Immediate Actions Required

• Upgrade Node.js to patched versions: 19.2.0 or later, 18.14.1 or later, 16.19.1 or later, or 14.21.3 or later depending on your release line
• Review the Node.js February 2023 Security Releases for complete details
• Inventory all Node.js deployments to ensure comprehensive patching
• Consider implementing request rate limiting for endpoints that trigger heavy cryptographic operations

Patch Information

Node.js has released security patches addressing this vulnerability across all supported release lines. The patches ensure proper clearing of the OpenSSL error stack after cryptographic operations to prevent error state from persisting across operation boundaries.

Patched versions:

• Node.js 19.2.0 and later (Current)
• Node.js 18.14.1 and later (LTS)
• Node.js 16.19.1 and later (LTS)
• Node.js 14.21.3 and later (LTS)

Additional details are available in HackerOne Report #1808596 and the NetApp Security Advisory.

Workarounds

• Implement application-level retry logic for cryptographic operations to handle transient false-positive failures
• Deploy request rate limiting on crypto-intensive endpoints to reduce thread pool contention
• Consider using worker threads with isolated contexts for cryptographic operations in critical paths
• Monitor and restart Node.js processes if cryptographic error rates exceed acceptable thresholds

# Check current Node.js version
node --version

# Update Node.js to patched version using nvm (example for 18.x LTS)
nvm install 18.14.1
nvm use 18.14.1

# Verify the update
node --version