The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8493 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network     applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and     efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8514 advisory.

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8468 advisory.

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8506 advisory.

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8467 advisory.

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8506 advisory.

    - Update to 22.16.0       Fixes: CVE-2025-23166
    - Patch fix for sqlite CVE-2025-31498       Resolves: RHEL-87300
    - Update c-ares to newest version with fix for CVE-2025-31498       Resolves: RHEL-86581
    - Upgrade to version 22.13.1       Fixes CVE-2025-23083 CVE-2025-23085 CVE-2025-22150       Resolves: RHEL-76362 RHEL-76897

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8468 advisory.

    nodejs     [1:20.19.2-1]
    - Update to version 20.19.2       Resolves: RHEL-92865 RHEL-88876 RHEL-91597

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8467 advisory.

    nodejs     [1:22.16.0-1]
    - Update to 22.16.0       Resolves: RHEL-89600 RHEL-92872 RHEL-92420

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8514 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8506 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8468 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8467 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-61ad6e65b3 advisory.

    Update to version 22.15.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-0c2b7a8f32 advisory.

    Update to 20.19.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 20.19.2, 22.15.1, 22.15.1, 23.11.1, 24.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, May 14, 2025 Security Releases advisory.

  - In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a     UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results     in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to     a denial of service. Impact: Thank you, to Justin Nietzel for reporting and fixing this vulnerability.
    (CVE-2025-23165)

  - The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime. Impact: Thank you, @panva and @tniessen, for reporting and fixing this     vulnerability. (CVE-2025-23166)

  - A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of     the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-     based access controls and submit unauthorized requests. The issue was resolved by upgrading llhttp to     version 9, which enforces correct header termination. Impact: Thank you, to kenballus for reporting this     vulnerability and thank you RafaelGSS for fixing it. (CVE-2025-23167)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237802	RHEL 10 : nodejs22 (RHSA-2025:8493)	Nessus	Red Hat Local Security Checks	high
237796	AlmaLinux 8 : nodejs:20 (ALSA-2025:8514)	Nessus	Alma Linux Local Security Checks	high
237793	AlmaLinux 9 : nodejs:20 (ALSA-2025:8468)	Nessus	Alma Linux Local Security Checks	high
237792	AlmaLinux 8 : nodejs:22 (ALSA-2025:8506)	Nessus	Alma Linux Local Security Checks	high
237791	AlmaLinux 9 : nodejs:22 (ALSA-2025:8467)	Nessus	Alma Linux Local Security Checks	high
237773	Oracle Linux 8 : nodejs:22 (ELSA-2025-8506)	Nessus	Oracle Linux Local Security Checks	high
237762	Oracle Linux 9 : nodejs:20 (ELSA-2025-8468)	Nessus	Oracle Linux Local Security Checks	high
237761	Oracle Linux 9 : nodejs:22 (ELSA-2025-8467)	Nessus	Oracle Linux Local Security Checks	high
237750	RHEL 8 : nodejs:20 (RHSA-2025:8514)	Nessus	Red Hat Local Security Checks	medium
237742	RHEL 8 : nodejs:22 (RHSA-2025:8506)	Nessus	Red Hat Local Security Checks	high
237726	RHEL 9 : nodejs:20 (RHSA-2025:8468)	Nessus	Red Hat Local Security Checks	medium
237725	RHEL 9 : nodejs:22 (RHSA-2025:8467)	Nessus	Red Hat Local Security Checks	high
237567	Photon OS 4.0: Nodejs PHSA-2025-4.0-0807	Nessus	PhotonOS Local Security Checks	high
237407	Fedora 41 : nodejs22 (2025-61ad6e65b3)	Nessus	Fedora Local Security Checks	high
237405	Fedora 41 : nodejs20 (2025-0c2b7a8f32)	Nessus	Fedora Local Security Checks	medium
236766	Node.js 20.x < 20.19.2 / 22.x < 22.15.1 / 22.x < 22.15.1 / 23.x < 23.11.1 / 24.x < 24.0.2 Multiple Vulnerabilities (Wednesday, May 14, 2025 Security Releases).	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-23166

high

Tenable Plugins

high

high

high

high

high

high

high

high

medium

high

medium

high

high

high

medium

medium