PT-2025-21253 · Node.Js+8 · Node.Js+8

Panva + 1 · CVE-2025-23166 · Published 2025-01-01 · Updated 2026-06-23

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Node.js versions 20.x through 24.x

Description Node.js is susceptible to a remote crash issue due to a flaw in the SignTraits::DeriveBits() function. This flaw can be triggered by malformed crypto input in background threads, leading to a denial-of-service condition. The issue arises from an incorrect call to ThrowException() based on user-supplied inputs. Approximately 17 million systems are potentially affected.

Recommendations Update Node.js to the latest version to address this issue.

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

ALSA-2025:8467

ALSA-2025:8468

ALSA-2025:8493

ALSA-2025:8506

ALSA-2025:8514

AZL-61919

AZL-65066

BDU:2025-10620

BIT-NODE-2025-23166

BIT-NODE-MIN-2025-23166

CESA-2025_8506

CESA-2025_8514

CVE-2025-23166

ECHO-37C8-1BFA-4CD1

INFSA-2025_8467

INFSA-2025_8468

INFSA-2025_8506

INFSA-2025_8514

MGASA-2025-0161

OESA-2025-1533

OESA-2025-1534

OPENSUSE-SU-2025:15250-1

OPENSUSE-SU-2025:15802-1

OPENSUSE-SU-2026:11110-1

RHSA-2025:8467

RHSA-2025:8468

RHSA-2025:8493

RHSA-2025:8506

RHSA-2025:8514

RHSA-2025:8902

RHSA-2025_8467

RHSA-2025_8468

RHSA-2025_8506

RHSA-2025_8514

SUSE-SU-2025:01878-1

SUSE-SU-2025:01879-1

SUSE-SU-2025:02039-1

SUSE-SU-2025:02045-1

SUSE-SU-2025_02039-1

SUSE-SU-2025_02045-1

Affected Products

Almalinux

Astra Linux

Centos

Debian

Node.Js

Red Hat

Red Os

Rocky Linux

Suse

References · 132

• https://osv.dev/vulnerability/SUSE-SU-2025:01878-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-23166 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15250-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-23166 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-65066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23166 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-23166 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:8514 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1534 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:8506 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-8514.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:8468 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-2025-23166 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-8467.html · Vendor Advisory