The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

suse_linux SUSE-SU-2025:01879-1: SUSE SLES15 : Security update for nodejs22 (Important) (SUSE-SU-2025:01879-1)

suse_linux SUSE-SU-2025:01878-1: SUSE SLES15 / openSUSE 15 : Security update for nodejs22 (Important) (SUSE-SU-2025:01878-1)

suse_linux SUSE-SU-2025:02045-1: SUSE openSUSE 15 : Security update for nodejs20 (Important) (SUSE-SU-2025:02045-1)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8902 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02039-1 advisory.

    Update to 20.19.2:

    - CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
    - CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).
    - CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).

    Other bugfixes:

    - Build with PIE (bsc#1239949)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0090 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-23165:
    In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`:
    a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This     results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth,     leading to a denial of service.
    Impact:
    * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.

    CVE-2025-23166:
    The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime.

    CVE-2025-23167:
    A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead     of the required `\r\n\r\n`.
    This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and     submit unauthorized requests.
    The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination.
    Impact:
    * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8514 advisory.

    - Update to version 20.19.2        Fixes: CVE-2025-23166        Resolves: RHEL-91595 RHEL-89598 RHEL-92854
    - Update c-ares to 1.34.5 to address CVE-2025-31498
    - Update to version 20.18.2       Fixes: CVE-2025-23083 CVE-2025-23085 CVE-2025-22150       Resolves: RHEL-76001 RHEL-76146
    - Update to 20.16.0       Fixes: CVE-2024-36137 CVE-2024-22018 CVE-2024-22020
    - Backport nghttp2 patch for CVE-2024-28182
    - Rebase to version 20.12.0       Addresses CVE-2024-27983 CVE-2024-27982 CVE-2024-22025 (node)       Addresses CVE-2024-25629 (c-ares)
    - Fixes: CVE-2024-21892 CVE-2024-21896 CVE-2024-22017 CVE-2024-22019 (high)
    - Fixes: CVE-2023-46809 CVE-2024-21890 CVE-2024-21891 (medium)
    - Fixes CVE-2023-44487 (nghttp)
    - Fixes CVE-2023-45143, CVE-2023-39331, CVE-2023-39332, CVE-2023-38552, CVE-2023-39333
    - Address CVE-2023-32002, CVE-2023-32004, CVE-2023-32558 (high)
    - Address CVE-2023-32006, CVE-2023-32559 (medium)
    - Address CVE-2023-32005, CVE-2023-32003 (low)
    - Rebase to 18.16.1       Resolves: rhbz#2188290 rhbz#2166926       Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590
    - Update bundled c-ares to 1.19.1       Resolves: CVE-2022-4904       Resolves: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067
    - Resolves: CVE-2022-25881, CVE-2023-23936, CVE-2023-24807
    - Resolves: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920
    - Rebase to version 18.12.1       Resolves: rhbz#2125580 CVE-2022-43548 CVE-2022-3517
    - Rebase to version 18.9.1       Resolves: CVE-2022-35255 CVE-2022-35256
    - Rebase to version 18.6.0       Resolves: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215       Resolves: CVE-2022-29244
    - Resolves: CVE-2021-43616
    - Resolves CVE-2021-32803, CVE-2021-32804, CVE-2021-37701, CVE-2021-37712
    - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939,
    - CVE-2021-22940, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
    - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939,
    - CVE-2021-22940, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
    - Resolves CVE-2021-22918(libuv)
    - Resolves CVE-2021-22883 CVE-2021-22884
    - Fix CVE-2020-10531

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1009 advisory.

    Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a     string, resulting in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory     growth, leading to a denial of service.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#corrupted-pointer-in-     nodefsreadfileutf8const-functioncallbackinfovalue-args-when-args0-is-a-string-cve-2025-23165---low     (CVE-2025-23165)

    Improper error handling in async cryptographic operations crashes process

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-error-handling-in-     async-cryptographic-operations-crashes-process-cve-2025-23166---high (CVE-2025-23166)

    Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1010 advisory.

    Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a     string, resulting in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory     growth, leading to a denial of service.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#corrupted-pointer-in-     nodefsreadfileutf8const-functioncallbackinfovalue-args-when-args0-is-a-string-cve-2025-23165---low     (CVE-2025-23165)

    Improper error handling in async cryptographic operations crashes process

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-error-handling-in-     async-cryptographic-operations-crashes-process-cve-2025-23166---high (CVE-2025-23166)

    Improper HTTP header block termination in llhttp which enables request smuggling, allowing attackers to     bypass proxy-based access controls and submit unauthorized requests. This vulnerability affects only     Node.js 20.x users prior to the llhttp v9 upgrade.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-http-header-block-     termination-in-llhttp-cve-2025-23167---medium (CVE-2025-23167)

    Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8493 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network     applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and     efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8514 advisory.

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8468 advisory.

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8506 advisory.

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8467 advisory.

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8506 advisory.

    - Update to 22.16.0       Fixes: CVE-2025-23166
    - Patch fix for sqlite CVE-2025-31498       Resolves: RHEL-87300
    - Update c-ares to newest version with fix for CVE-2025-31498       Resolves: RHEL-86581
    - Upgrade to version 22.13.1       Fixes CVE-2025-23083 CVE-2025-23085 CVE-2025-22150       Resolves: RHEL-76362 RHEL-76897

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8468 advisory.

    nodejs     [1:20.19.2-1]
    - Update to version 20.19.2       Resolves: RHEL-92865 RHEL-88876 RHEL-91597

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8467 advisory.

    nodejs     [1:22.16.0-1]
    - Update to 22.16.0       Resolves: RHEL-89600 RHEL-92872 RHEL-92420

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8514 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8506 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8468 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8467 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-61ad6e65b3 advisory.

    Update to version 22.15.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-0c2b7a8f32 advisory.

    Update to 20.19.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 20.19.2, 22.15.1, 22.15.1, 23.11.1, 24.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, May 14, 2025 Security Releases advisory.

  - In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a     UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results     in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to     a denial of service. Impact: Thank you, to Justin Nietzel for reporting and fixing this vulnerability.
    (CVE-2025-23165)

  - The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime. Impact: Thank you, @panva and @tniessen, for reporting and fixing this     vulnerability. (CVE-2025-23166)

  - A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of     the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-     based access controls and submit unauthorized requests. The issue was resolved by upgrading llhttp to     version 9, which enforces correct header termination. Impact: Thank you, to kenballus for reporting this     vulnerability and thank you RafaelGSS for fixing it. (CVE-2025-23167)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
240660	RHEL 9 : nodejs:20 (RHSA-2025:8902)	Nessus	Red Hat Local Security Checks	high
240594	SUSE SLES15 Security Update : nodejs20 (SUSE-SU-2025:02039-1)	Nessus	SuSE Local Security Checks	medium
240278	Alibaba Cloud Linux 3 : 0090: nodejs:20 (ALINUX3-SA-2025:0090)	Nessus	Alibaba Cloud Linux Local Security Checks	medium
238415	Oracle Linux 8 : nodejs:20 (ELSA-2025-8514)	Nessus	Oracle Linux Local Security Checks	high
238268	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2025-1009)	Nessus	Amazon Linux Local Security Checks	high
238264	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2025-1010)	Nessus	Amazon Linux Local Security Checks	medium
237802	RHEL 10 : nodejs22 (RHSA-2025:8493)	Nessus	Red Hat Local Security Checks	high
237796	AlmaLinux 8 : nodejs:20 (ALSA-2025:8514)	Nessus	Alma Linux Local Security Checks	high
237793	AlmaLinux 9 : nodejs:20 (ALSA-2025:8468)	Nessus	Alma Linux Local Security Checks	high
237792	AlmaLinux 8 : nodejs:22 (ALSA-2025:8506)	Nessus	Alma Linux Local Security Checks	high
237791	AlmaLinux 9 : nodejs:22 (ALSA-2025:8467)	Nessus	Alma Linux Local Security Checks	high
237773	Oracle Linux 8 : nodejs:22 (ELSA-2025-8506)	Nessus	Oracle Linux Local Security Checks	high
237762	Oracle Linux 9 : nodejs:20 (ELSA-2025-8468)	Nessus	Oracle Linux Local Security Checks	high
237761	Oracle Linux 9 : nodejs:22 (ELSA-2025-8467)	Nessus	Oracle Linux Local Security Checks	high
237750	RHEL 8 : nodejs:20 (RHSA-2025:8514)	Nessus	Red Hat Local Security Checks	medium
237742	RHEL 8 : nodejs:22 (RHSA-2025:8506)	Nessus	Red Hat Local Security Checks	high
237726	RHEL 9 : nodejs:20 (RHSA-2025:8468)	Nessus	Red Hat Local Security Checks	medium
237725	RHEL 9 : nodejs:22 (RHSA-2025:8467)	Nessus	Red Hat Local Security Checks	high
237567	Photon OS 4.0: Nodejs PHSA-2025-4.0-0807	Nessus	PhotonOS Local Security Checks	high
237407	Fedora 41 : nodejs22 (2025-61ad6e65b3)	Nessus	Fedora Local Security Checks	high
237405	Fedora 41 : nodejs20 (2025-0c2b7a8f32)	Nessus	Fedora Local Security Checks	medium
236766	Node.js 20.x < 20.19.2 / 22.x < 22.15.1 / 22.x < 22.15.1 / 23.x < 23.11.1 / 24.x < 24.0.2 Multiple Vulnerabilities (Wednesday, May 14, 2025 Security Releases).	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-23166

high

Tenable Plugins

Coming Soon

high

medium

medium

high

high

medium

high

high

high

high

high

high

high

high

medium

high

medium

high

high

high

medium

medium