A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

suse_linux SUSE-SU-2025:02045-1: SUSE openSUSE 15 : Security update for nodejs20 (Important) (SUSE-SU-2025:02045-1)

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02039-1 advisory.

    Update to 20.19.2:

    - CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
    - CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).
    - CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).

    Other bugfixes:

    - Build with PIE (bsc#1239949)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0090 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-23165:
    In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`:
    a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This     results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth,     leading to a denial of service.
    Impact:
    * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.

    CVE-2025-23166:
    The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime.

    CVE-2025-23167:
    A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead     of the required `\r\n\r\n`.
    This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and     submit unauthorized requests.
    The issue was resolved by upgrading `llhttp` to version 9, which enforces correct header termination.
    Impact:
    * This vulnerability affects only Node.js 20.x users prior to the `llhttp` v9 upgrade.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1010 advisory.

    Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a     string, resulting in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory     growth, leading to a denial of service.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#corrupted-pointer-in-     nodefsreadfileutf8const-functioncallbackinfovalue-args-when-args0-is-a-string-cve-2025-23165---low     (CVE-2025-23165)

    Improper error handling in async cryptographic operations crashes process

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-error-handling-in-     async-cryptographic-operations-crashes-process-cve-2025-23166---high (CVE-2025-23166)

    Improper HTTP header block termination in llhttp which enables request smuggling, allowing attackers to     bypass proxy-based access controls and submit unauthorized requests. This vulnerability affects only     Node.js 20.x users prior to the llhttp v9 upgrade.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-http-header-block-     termination-in-llhttp-cve-2025-23167---medium (CVE-2025-23167)

    Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8514 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8468 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-0c2b7a8f32 advisory.

    Update to 20.19.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 20.19.2, 22.15.1, 22.15.1, 23.11.1, 24.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the Wednesday, May 14, 2025 Security Releases advisory.

  - In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a     UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results     in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to     a denial of service. Impact: Thank you, to Justin Nietzel for reporting and fixing this vulnerability.
    (CVE-2025-23165)

  - The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime. Impact: Thank you, @panva and @tniessen, for reporting and fixing this     vulnerability. (CVE-2025-23166)

  - A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of     the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-     based access controls and submit unauthorized requests. The issue was resolved by upgrading llhttp to     version 9, which enforces correct header termination. Impact: Thank you, to kenballus for reporting this     vulnerability and thank you RafaelGSS for fixing it. (CVE-2025-23167)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
240594	SUSE SLES15 Security Update : nodejs20 (SUSE-SU-2025:02039-1)	Nessus	SuSE Local Security Checks	medium
240522	Photon OS 4.0: Nodejs PHSA-2025-4.0-0820	Nessus	PhotonOS Local Security Checks	high
240278	Alibaba Cloud Linux 3 : 0090: nodejs:20 (ALINUX3-SA-2025:0090)	Nessus	Alibaba Cloud Linux Local Security Checks	medium
238264	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2025-1010)	Nessus	Amazon Linux Local Security Checks	medium
237750	RHEL 8 : nodejs:20 (RHSA-2025:8514)	Nessus	Red Hat Local Security Checks	medium
237726	RHEL 9 : nodejs:20 (RHSA-2025:8468)	Nessus	Red Hat Local Security Checks	medium
237405	Fedora 41 : nodejs20 (2025-0c2b7a8f32)	Nessus	Fedora Local Security Checks	medium
236766	Node.js 20.x < 20.19.2 / 22.x < 22.15.1 / 22.x < 22.15.1 / 23.x < 23.11.1 / 24.x < 24.0.2 Multiple Vulnerabilities (Wednesday, May 14, 2025 Security Releases).	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-23167

medium

Tenable Plugins

Coming Soon

medium

high

medium

medium

medium

medium

medium

medium