CVE-2025-23166
Published: May 16, 2025Last modified: October 1, 2025
Description
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity impact | NONE |
| Availability impact | HIGH |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Notes
23-lts ships nodejs 18-LTS that is no longer supported. https://github.com/nodejs/node/commit/6c57465920cf1b981a63031e71b1e4a73bf9beaa
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | nodejs | Vulnerable (18.16.0-r0) |
| openjdk-nik-23-17 | Fixed (23.0.9-r0) | ||
| openjdk-nik-23-21 | Fixed (23.1.8-r0) | ||
| openjdk-nik-24-24 | Fixed (24.2.2-r0) | ||
| 25 LTS | openjdk-nik-23-17 | Fixed (23.0.9-r0) | |
| openjdk-nik-23-21 | Fixed (23.1.8-r0) | ||
| openjdk-nik-24-24 | Fixed (24.2.2-r0) | ||
| Stream | nodejs | Fixed (22.16.0-r0) | |
| openjdk-nik-23-17 | Fixed (23.0.9-r0) | ||
| openjdk-nik-23-21 | Fixed (23.1.8-r0) | ||
| openjdk-nik-24-24 | Fixed (24.2.2-r0) | ||
| Hardened Containers | 23 LTS | openjdk-nik-23-17 | Fixed (23.0.9-r0) |
| openjdk-nik-23-21 | Fixed (23.1.8-r0) | ||
| openjdk-nik-24-24 | Fixed (24.2.2-r0) | ||
| Stream | openjdk-nik-23-17 | Fixed (23.0.9-r0) | |
| openjdk-nik-23-21 | Fixed (23.1.8-r0) | ||
| openjdk-nik-24-24 | Fixed (24.2.2-r0) | ||
| Liberica NIK | 23 (JDK 17) | core | Fixed (23.0.9+1) |
| standard (nodejs) | Fixed (23.0.9+1) | ||
| 23 (JDK 21) | core | Fixed (23.1.8+1) | |
| standard (nodejs) | Fixed (23.1.8+1) | ||
| 24 (JDK 24) | nodejs | Fixed (24.2.2+1) |