The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on…
Priority MEDIUM 40CWE-248Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-248.
Summary
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00817 57th percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NodeJS | node | 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 and later; 15.0 and later; 16.0 and later; 17.0 and later; 18.0 and later; 19.0 and later; 20.0 – 20.19.1; 22.0 – 22.15.0; 23.0 – 23.11.0; 24.0 – 24.0.1; 21.0 and later | — | No fix listed | CNA |
- node VendorNodeJS Affected 4.0 and later; 5.0 and later; 6.0 and later; 7.0 and later; 8.0 and later; 9.0 and later; 10.0 and later; 11.0 and later; 12.0 and later; 13.0 and later; 14.0 and later; 15.0 and later; 16.0 and later; 17.0 and later; 18.0 and later; 19.0 and later; 20.0 – 20.19.1; 22.0 – 22.15.0; 23.0 – 23.11.0; 24.0 – 24.0.1; 21.0 and later Fixed in — No fix listed CNA
Remediation
Red Hat 6 advisories
- RHSA-2025:8902 Released 2025-06-11 · Red Hat rating Importantnodejs:20 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) nodejs-1:20.19.2-2.module+el9.4.0+23180+d266bac7.aarch64::nodejs:20, nodejs-1:20.19.2-2.module+el9.4.0+23180+d266bac7.ppc64le::nodejs:20, nodejs-1:20.19.2-2.module+el9.4.0+23180+d266bac7.s390x::nodejs:20 +20
- RHSA-2025:8514 Released 2025-06-04 · Red Hat rating Importantnodejs:20 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.19.2-1.module+el8.10.0+23139+21ba74c5.aarch64::nodejs:20, nodejs-1:20.19.2-1.module+el8.10.0+23139+21ba74c5.ppc64le::nodejs:20, nodejs-1:20.19.2-1.module+el8.10.0+23139+21ba74c5.s390x::nodejs:20 +20
- RHSA-2025:8506 Released 2025-06-04 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.16.0-1.module+el8.10.0+23140+4056b950.aarch64::nodejs:22, nodejs-1:22.16.0-1.module+el8.10.0+23140+4056b950.ppc64le::nodejs:22, nodejs-1:22.16.0-1.module+el8.10.0+23140+4056b950.s390x::nodejs:22 +28
Show 3 more Red Hat advisories
- RHSA-2025:8493 Released 2025-06-04 · Red Hat rating Importantnodejs22 security update
- Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.16.0-1.el10_0, nodejs-devel-1:22.16.0-1.el10_0, nodejs-docs-1:22.16.0-1.el10_0 +4
- RHSA-2025:8467 Released 2025-06-03 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.16.0-1.module+el9.6.0+23151+b1496e9d.aarch64::nodejs:22, nodejs-1:22.16.0-1.module+el9.6.0+23151+b1496e9d.ppc64le::nodejs:22, nodejs-1:22.16.0-1.module+el9.6.0+23151+b1496e9d.s390x::nodejs:22 +28
- RHSA-2025:8468 Released 2025-06-03 · Red Hat rating Importantnodejs:20 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:20.19.2-1.module+el9.6.0+23146+be9976bd.aarch64::nodejs:20, nodejs-1:20.19.2-1.module+el9.6.0+23146+be9976bd.ppc64le::nodejs:20, nodejs-1:20.19.2-1.module+el9.6.0+23146+be9976bd.s390x::nodejs:20 +20
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
nodejs node 10.*, 11.* and 15 more versions
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2025-16950 Memory leak in NodeJS nodePriority MEDIUM 51
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:8493 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:8506, RHSA-2025:8514 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:8467, RHSA-2025:8468 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:8902 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-23166
- 2026-10-03 Alias added: GHSA-rrjv-57mm-j6cm
References
More NodeJS vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-18584 Race condition in NodeJS Node CVSS 3.0HIGH 8.2
- TI-2016-01993 The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other… CVSS 3.1HIGH 7.5
- TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
- TI-2022-03472 X.509 Email Address Variable Length Buffer Overflow CVSS 3.1HIGH 7.5
Sources
- CVE-2025-23166 · CVE Program
- CVE-2025-23166 · NVD
- FIRST EPSS
- GHSA-rrjv-57mm-j6cm · GitHub Advisory Database · CC BY 4.0
- CVE-2025-23166 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences