OESA-2025-1534 (CVE-2025-23165)
Vulnerability from osv_openeuler – Published: 2025-05-23 11:08 – Updated: 2026-08-06 11:08 – Source websiteNode.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.
Security Fix(es):
In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.
Impact:
* This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.(CVE-2025-23165)
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.(CVE-2025-23166)
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"nodejs-20.18.2-3.oe2403sp1.aarch64.rpm",
"nodejs-debuginfo-20.18.2-3.oe2403sp1.aarch64.rpm",
"nodejs-debugsource-20.18.2-3.oe2403sp1.aarch64.rpm",
"nodejs-devel-20.18.2-3.oe2403sp1.aarch64.rpm",
"nodejs-full-i18n-20.18.2-3.oe2403sp1.aarch64.rpm",
"nodejs-libs-20.18.2-3.oe2403sp1.aarch64.rpm",
"npm-10.8.2-1.20.18.2.3.oe2403sp1.aarch64.rpm",
"v8-devel-11.3.244.8-1.20.18.2.3.oe2403sp1.aarch64.rpm"
],
"noarch": [
"nodejs-docs-20.18.2-3.oe2403sp1.noarch.rpm"
],
"src": [
"nodejs-20.18.2-3.oe2403sp1.src.rpm"
],
"x86_64": [
"nodejs-20.18.2-3.oe2403sp1.x86_64.rpm",
"nodejs-debuginfo-20.18.2-3.oe2403sp1.x86_64.rpm",
"nodejs-debugsource-20.18.2-3.oe2403sp1.x86_64.rpm",
"nodejs-devel-20.18.2-3.oe2403sp1.x86_64.rpm",
"nodejs-full-i18n-20.18.2-3.oe2403sp1.x86_64.rpm",
"nodejs-libs-20.18.2-3.oe2403sp1.x86_64.rpm",
"npm-10.8.2-1.20.18.2.3.oe2403sp1.x86_64.rpm",
"v8-devel-11.3.244.8-1.20.18.2.3.oe2403sp1.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS-SP1",
"name": "nodejs",
"purl": "pkg:rpm/openEuler/nodejs\u0026distro=openEuler-24.03-LTS-SP1"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "20.18.2-3.oe2403sp1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "High"
},
"details": "Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nIn Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\n\nImpact:\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.(CVE-2025-23165)\n\nThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.(CVE-2025-23166)",
"id": "OESA-2025-1534",
"modified": "2026-08-06T11:08:37Z",
"published": "2025-05-23T11:08:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1534"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23165"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23166"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "nodejs security update",
"upstream": [
"CVE-2025-23165",
"CVE-2025-23166"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.