Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-30590

CVE-2023-30590HIGH

NodeJS Node — The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only ge…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  H  N    7.5   .0146   73.2     —

AFFECTED
  Product  Versions  Fixed
  Node     4.0 –     —

TIMELINE
  Apr 13  Reserved by hackerone
  Nov 28  Published (CNA: hackerone)
  Oct 8   ENRICHED — CVE-2023-30590 (NodeJS Node). Received CVSS 7.5 and CPE data from NVD.

CNA: hackerone · CVSS v3.1 · 4 references · NVD status: Modified

Description

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
April 13, 2023	Reserved	Reserved by hackerone
November 28, 2023	Published	Published (CNA: hackerone)
October 8, 2026	ENRICHED	ENRICHED — CVE-2023-30590 (NodeJS Node). Received CVSS 7.5 and CPE data from NVD.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
NodeJS	Node	—	4.0	—

References (4)

Authoritative record: CVE-2023-30590 at cve.org

Vendors: nodejs

About this page