CVE-2025-23166
Published: May 16, 2025Last modified: July 18, 2025
Description
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity impact | NONE |
| Availability impact | HIGH |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Notes
23-lts ships nodejs 18-LTS that is no longer supported. https://github.com/nodejs/node/commit/6c57465920cf1b981a63031e71b1e4a73bf9beaa
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | nodejs | Vulnerable (18.16.0-r0) |
| Stream | nodejs | Fixed (22.16.0-r0) | |
| Liberica NIK | 24 (JDK 24) | nodejs | Vulnerable (24.2.0+1) |