Riskcovery

CVE-2025-23166

State
Published
Severity
7.5 High
Published
May 19, 2025
Updated
May 28, 2025
Reserved
Jan 12, 2025

Read the record on cve.org

Description

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

Scores

CVSSScoreVectorSource
3.07.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hhackerone

Weaknesses

Affected Products

ProductVersions
nodenodejs
  • 4.0 to before 4.*Affected
  • 5.0 to before 5.*Affected
  • 6.0 to before 6.*Affected
  • 7.0 to before 7.*Affected
  • 8.0 to before 8.*Affected
  • 9.0 to before 9.*Affected
  • 10.0 to before 10.*Affected
  • 11.0 to before 11.*Affected
  • 12.0 to before 12.*Affected
  • 13.0 to before 13.*Affected
  • 14.0 to before 14.*Affected
  • 15.0 to before 15.*Affected
  • 16.0 to before 16.*Affected
  • 17.0 to before 17.*Affected
  • 18.0 to before 18.*Affected
  • 19.0 to before 19.*Affected
  • 20.0 through 20.19.1Affected
  • 22.0 through 22.15.0Affected
  • 23.0 through 23.11.0Affected
  • 24.0 through 24.0.1Affected
  • 21.0 to before 21.*Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.