It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1009 advisory.

    Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a     string, resulting in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory     growth, leading to a denial of service.

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#corrupted-pointer-in-     nodefsreadfileutf8const-functioncallbackinfovalue-args-when-args0-is-a-string-cve-2025-23165---low     (CVE-2025-23165)

    Improper error handling in async cryptographic operations crashes process

    Info: https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#improper-error-handling-in-     async-cryptographic-operations-crashes-process-cve-2025-23166---high (CVE-2025-23166)

    Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that     use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an     invalid certificate, and they can force the application to call the webhook repeatedly, then they can     cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid     calling a webhook repeatedly if the webhook fails. (CVE-2025-47279)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02045-1 advisory.

    Update to 20.19.2:

    - CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
    - CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).
    - CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).

    Other bugfixes:

    - Build with PIE (bsc#1239949)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nodejs / nodejs18 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-23166 advisory.

  - The C++ method SignTraits::DeriveBits() May incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime. (CVE-2025-23166)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime. (CVE-2025-23166)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770140451 advisory.

  - The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime. (CVE-2025-23166)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0462 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-23165:
    In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a     UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results     in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to     a denial of service.

    Impact:
    * This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.

    CVE-2025-23166:
    The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied     inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations     are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely     crash a Node.js runtime.

    CVE-2025-23167:
    A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of     the required \r\n\r\n.
    This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and     submit unauthorized requests.

    The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

    Impact:
    * This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10001:01 advisory.

    * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
238268	Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2025-1009)	Nessus	Amazon Linux Local Security Checks	6/12/2025	6/12/2025	high
241098	SUSE SLES15 / openSUSE 15 Security Update : nodejs20 (SUSE-SU-2025:02045-1)	Nessus	SuSE Local Security Checks	7/1/2025	7/1/2025	medium
242380	Azure Linux 3.0 Security Update: nodejs / nodejs18 (CVE-2025-23166)	Nessus	Azure Linux Local Security Checks	7/19/2025	9/15/2025	high
251922	Linux Distros Unpatched Vulnerability : CVE-2025-23166	Nessus	Misc.	8/19/2025	8/6/2026	high
352723	Rocky Linux 9.6 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc (ALMALINUX9.6:CLSA-2026:1770140451)	Nessus	Rocky Linux Local Security Checks	9/30/2026	9/30/2026	high
276301	TencentOS Server 3: nodejs:20 (TSSA-2025:0462)	Nessus	Tencent Local Security Checks	11/20/2025	12/4/2025	medium
282923	MiracleLinux 8 : nodejs:22 (AXSA:2025-10001:01)	Nessus	Miracle Linux Local Security Checks	1/13/2026	1/20/2026	high

Detections

Analytics

Plugins Search

high

medium

high

high

high

medium

high