CVE-2025-23166 Denial of service in node
An attacker can remotely crash the Node.js runtime by supplying crafted inputs to cryptographic operations, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-23166?
CVE-2025-23166 is a high-severity denial of service vulnerability in nodejs node, published on 19 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
Weakness: CWE-248
Which versions are affected by CVE-2025-23166?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 20.19.2, 22.15.1, 24.0.2 |
node-min Bitnami | All versions | 20.19.2, 22.15.1, 24.0.2 |
Linux distribution packages (38)
nodejs-docs AlmaLinux:10 | All versions | 1:22.16.0-1.el10_0 |
nodejs AlmaLinux:8 | All versions | 1:20.19.2-1.module_el8.10.0+4007+01f7d99b |
nodejs AlmaLinux:8 | All versions | 1:22.16.0-1.module_el8.10.0+4006+3c416519 |
nodejs-devel AlmaLinux:8 | All versions | 1:20.19.2-1.module_el8.10.0+4007+01f7d99b |
nodejs-devel AlmaLinux:8 | All versions | 1:22.16.0-1.module_el8.10.0+4006+3c416519 |
nodejs-docs AlmaLinux:8 | All versions | 1:20.19.2-1.module_el8.10.0+4007+01f7d99b |
nodejs-docs AlmaLinux:8 | All versions | 1:22.16.0-1.module_el8.10.0+4006+3c416519 |
nodejs-full-i18n AlmaLinux:8 | All versions | 1:20.19.2-1.module_el8.10.0+4007+01f7d99b |
nodejs-full-i18n AlmaLinux:8 | All versions | 1:22.16.0-1.module_el8.10.0+4006+3c416519 |
nodejs-libs AlmaLinux:8 | All versions | 1:22.16.0-1.module_el8.10.0+4006+3c416519 |
nodejs-nodemon AlmaLinux:8 | All versions | 3.0.1-1.module_el8.10.0+3982+85c136aa |
nodejs-nodemon AlmaLinux:8 | All versions | 3.0.1-1.module_el8.10.0+3983+391a1a04 |
nodejs-packaging AlmaLinux:8 | All versions | 2021.06-4.module_el8.10.0+3987+dbda4426 |
nodejs-packaging AlmaLinux:8 | All versions | 2021.06-4.module_el8.10.0+4006+3c416519 |
nodejs-packaging-bundler AlmaLinux:8 | All versions | 2021.06-4.module_el8.10.0+3958+472a6467 |
nodejs-packaging-bundler AlmaLinux:8 | All versions | 2021.06-4.module_el8.10.0+3961+6a788e57 |
npm AlmaLinux:8 | All versions | 1:10.8.2-1.20.19.2.1.module_el8.10.0+4007+01f7d99b |
npm AlmaLinux:8 | All versions | 1:10.9.2-1.22.16.0.1.module_el8.10.0+4006+3c416519 |
v8-12.4-devel AlmaLinux:8 | All versions | 3:12.4.254.21-1.22.16.0.1.module_el8.10.0+4006+3c416519 |
nodejs AlmaLinux:9 | All versions | 1:20.19.2-1.module_el9.6.0+169+c9cb05c2 |
nodejs AlmaLinux:9 | All versions | 1:22.16.0-1.module_el9.6.0+170+f035de78 |
nodejs-devel AlmaLinux:9 | All versions | 1:20.19.2-1.module_el9.6.0+169+c9cb05c2 |
nodejs-devel AlmaLinux:9 | All versions | 1:22.16.0-1.module_el9.6.0+170+f035de78 |
nodejs-docs AlmaLinux:9 | All versions | 1:20.19.2-1.module_el9.6.0+169+c9cb05c2 |
nodejs-docs AlmaLinux:9 | All versions | 1:22.16.0-1.module_el9.6.0+170+f035de78 |
nodejs-full-i18n AlmaLinux:9 | All versions | 1:20.19.2-1.module_el9.6.0+169+c9cb05c2 |
nodejs-full-i18n AlmaLinux:9 | All versions | 1:22.16.0-1.module_el9.6.0+170+f035de78 |
nodejs-libs AlmaLinux:9 | All versions | 1:22.16.0-1.module_el9.6.0+170+f035de78 |
nodejs-nodemon AlmaLinux:9 | All versions | 3.0.1-1.module_el9.5.0+125+8dc38870 |
nodejs-nodemon AlmaLinux:9 | All versions | 3.0.1-1.module_el9.5.0+139+09296491 |
nodejs-packaging AlmaLinux:9 | All versions | 2021.06-4.module_el9.5.0+139+09296491 |
nodejs-packaging AlmaLinux:9 | All versions | 2021.06-4.module_el9.6.0+162+8dc602e5 |
nodejs-packaging-bundler AlmaLinux:9 | All versions | 2021.06-4.module_el9.5.0+139+09296491 |
nodejs-packaging-bundler AlmaLinux:9 | All versions | 2021.06-4.module_el9.6.0+162+8dc602e5 |
npm AlmaLinux:9 | All versions | 1:10.8.2-1.20.19.2.1.module_el9.6.0+169+c9cb05c2 |
npm AlmaLinux:9 | All versions | 1:10.9.2-1.22.16.0.1.module_el9.6.0+170+f035de78 |
v8-12.4-devel AlmaLinux:9 | All versions | 3:12.4.254.21-1.22.16.0.1.module_el9.6.0+170+f035de78 |
nodejs Red Hat:rhel_eus:9.4::appstream | All versions | 1:20.19.2-2.module+el9.4.0+23180+d266bac7 |
How do I fix CVE-2025-23166?
Upgrade node to a fixed version for your release line: 20.19.2, 22.15.1 or 24.0.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-23166 being exploited?
There is no known exploitation of CVE-2025-23166 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-23166, ALSA-2025:8467, ALSA-2025:8468, ALSA-2025:8493, ALSA-2025:8506, ALSA-2025:8514 and 16 more.