PT-2025-29694 · Node.Js · Node.Js

Sharp_Edged · Published 2025-07-15 · Updated 2025-07-22 · CVE-2025-27209

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Node.js versions 24.0.0 and later

Description The V8 release in Node.js reintroduced a HashDoS vulnerability due to changes in string hash computation using rapidhash. An attacker controlling the strings to be hashed can generate numerous hash collisions, even without knowing the hash seed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Memory Leak

Weakness Enumeration

CWE-22

CWE-407

CWE-401

Related Identifiers

BDU:2025-09382

BDU:2025-09383

BIT-NODE-2025-27209

BIT-NODE-MIN-2025-27209

CVE-2025-27209

Affected Products

Node.Js

References · 24

• 🔥 https://github.com/mindeddu/Vulnerable-CVE-2025-27210 · Exploit
• https://bdu.fstec.ru/vul/2025-09382 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-27209 · Security Note
• https://bdu.fstec.ru/vul/2025-09383 · Security Note
• https://osv.dev/vulnerability/BIT-node-2025-27209 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-min-2025-27209 · Vendor Advisory
• https://twitter.com/CVEnew/status/1946348333079093734 · Twitter Post
• https://twitter.com/fridaysecurity/status/1945298076945486156 · Twitter Post
• https://nodejs.org/en/blog/vulnerability/july-2025-security-releases#hashdos-in-v8-cve-2025-27209---high · Note
• https://twitter.com/autumn_good_35/status/1945415049566445584 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1946388137984377267 · Twitter Post
• https://twitter.com/_havij/status/1945678681814503795 · Twitter Post
• https://t.me/pentestingnews/64646 · Telegram Post
• https://1275.ru/vulnerability/kriticheskie-uyazvimosti-v-node-js-ugrozhayut-bezopasnosti-windows-prilozheniy-patch-traversal-i-hashdos-ataki_13006 · Note
• http://openwall.com/lists/oss-security/2025/07/22/2 · Note