PT-2026-28543 · Unknown · Elixir-Nodejs

Published 2026-03-26 · Updated 2026-03-28 · CVE-2026-33872

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions elixir-nodejs versions prior to 3.1.4

Description elixir-nodejs is an Elixir API for calling Node.js functions. A flaw exists due to a race condition in the worker protocol, leading to Cross-User Data Leakage or Information Disclosure. The absence of request-response correlation results in a "stale response" issue where the worker may return data intended for a different user. In high-throughput scenarios processing sensitive data like PII or authentication tokens, timeouts or high concurrency can cause a user to receive data belonging to another user. This can lead to unauthorized disclosure of information without triggering errors, potentially providing incorrect data to the wrong session.

Recommendations Update to version 3.1.4 or later.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-33872

GHSA-RWCR-RPCC-3G9M

Affected Products

Elixir-Nodejs

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33872.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-33872 · Security Note
• https://osv.dev/vulnerability/GHSA-rwcr-rpcc-3g9m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33872 · Vendor Advisory
• https://github.com/revelrylabs/elixir-nodejs/releases/tag/v3.1.4 · Note
• https://github.com/revelrylabs/elixir-nodejs/issues/100 · Note
• https://github.com/revelrylabs/elixir-nodejs · Note
• https://github.com/revelrylabs/elixir-nodejs/security/advisories/GHSA-rwcr-rpcc-3g9m · Note
• https://github.com/revelrylabs/elixir-nodejs/pull/105 · Note
• https://twitter.com/CVEnew/status/2037719402653839866 · Twitter Post