PT-2025-4813 · Node.Js+8 · Node.Js+8
Leodog896
·
Published
2025-01-21
·
Updated
2025-12-08
·
CVE-2025-23083
CVSS v3.1
7.7
High
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Node.js versions v20, v22, and v23
Description
The diagnostics channel utility allows an event to be hooked into whenever a worker thread is created, exposing not only workers but also internal workers. This enables malicious actors to fetch instances of these workers, access their constructors, and potentially reinstate them for malicious purposes. The issue affects Permission Model users (--permission) and can be used to expose sensitive data and resources.
Recommendations
For Node.js versions v20, v22, and v23, consider disabling the diagnostics channel utility as a temporary workaround to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Node.Js
Red Hat
Red Os
Rocky Linux
Suse