PT-2025-18371 · Node.Js+3 · Node.Js+3

Published 2013-01-09 · Updated 2025-08-29 · CVE-2025-47153

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions libuv and Node.js versions prior to nodejs 20.19.0+dfsg-2 i386.deb

Description The issue arises from certain build processes for libuv and Node.js on 32-bit systems, where the off t size is inconsistent. This inconsistency occurs because the build process for the libuv dynamic library always uses FILE OFFSET BITS=64, while the nodejs build uses the global system default of 32. This leads to out-of-bounds access. It is noted that this is not a problem in the Node.js software itself, but rather in the build process for certain binary packages, such as those for Debian GNU/Linux.

Recommendations For versions prior to nodejs 20.19.0+dfsg-2 i386.deb, consider rebuilding the nodejs package with consistent FILE OFFSET BITS settings to prevent out-of-bounds access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1102

Related Identifiers

BDU:2025-12472

CVE-2025-47153

DLA-4152-1

DSA-5991-1

ECHO-4BB3-068F-64A1

Affected Products

Astra Linux

Debian

Node.Js

Libuv

References · 28

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4152-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-47153 · Security Note
• https://ubuntu.com/security/CVE-2025-47153 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-47153 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47153 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5991-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-47153 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-47153 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12472 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-47153 · Security Note
• https://github.com/nodejs/node-v0.x-archive/issues/4549 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076350 · Note