CVE-2024-22017
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presum…
Published: 2024-03-19 · CVSS: 7.3 · CVSS 3.0
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7