PT-2025-21253 · Node.Js+8 · Node.Js+8

Panva + 1 · Published 2025-01-01 · Updated 2025-12-08 · CVE-2025-23166

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Node.js versions 20.x through 24.x

Description Node.js is susceptible to a remote crash issue due to a flaw in the SignTraits::DeriveBits() function. This flaw can be triggered by malformed crypto input in background threads, leading to a denial-of-service condition. The issue arises from an incorrect call to ThrowException() based on user-supplied inputs. Approximately 17 million systems are potentially affected.

Recommendations Update Node.js to the latest version to address this issue.

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

ALSA-2025:8467

ALSA-2025:8468

ALSA-2025:8493

ALSA-2025:8506

ALSA-2025:8514

AZL-61919

AZL-65066

BDU:2025-10620

BIT-NODE-2025-23166

BIT-NODE-MIN-2025-23166

CESA-2025_8506

CESA-2025_8514

CVE-2025-23166

ECHO-37C8-1BFA-4CD1

INFSA-2025_8467

INFSA-2025_8468

INFSA-2025_8506

INFSA-2025_8514

MGASA-2025-0161

OESA-2025-1533

OESA-2025-1534

OPENSUSE-SU-2025:15250-1

OPENSUSE-SU-2025:15802-1

RHSA-2025:8467

RHSA-2025:8468

RHSA-2025:8493

RHSA-2025:8506

RHSA-2025:8514

RHSA-2025:8902

RHSA-2025_8467

RHSA-2025_8468

RHSA-2025_8506

RHSA-2025_8514

SUSE-SU-2025:01878-1

SUSE-SU-2025:01879-1

SUSE-SU-2025:02039-1

SUSE-SU-2025:02045-1

SUSE-SU-2025_02039-1

SUSE-SU-2025_02045-1

Affected Products

Almalinux

Astra Linux

Centos

Debian

Node.Js

Red Hat

Red Os

Rocky Linux

Suse

References · 101

• https://osv.dev/vulnerability/AZL-65066 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1533 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-23166 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2025-8467.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-23166 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-8467.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-min-2025-23166 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:8467 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2025-8514.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:8468 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10620 · Security Note
• https://osv.dev/vulnerability/CVE-2025-23166 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-23166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23166 · Security Note