CVE-2025-23166 Details
Description
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
A vulnerability exists in the Node.js runtime in release lines 20.x, 22.x, 23.x, and 24.x. The issue arises in the C++ method SignTraits::DeriveBits(), where improper error handling can occur during asynchronous cryptographic operations. When this method is executed in a background thread, it may incorrectly invoke ThrowException() based on user-supplied inputs, potentially causing the Node.js process to crash. This vulnerability is particularly concerning because cryptographic operations often involve untrusted inputs, allowing an adversary to remotely disrupt the Node.js runtime.
Users can upgrade to the latest versions of Node.js in the 20.x, 22.x, 23.x, and 24.x release lines to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 19, 2025CISA-ADP
Assessed May 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://nodejs.org/en/blog/vulnerability/may-2025-security-releases | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Node.js | ~24 ~23 ~22 ~20 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2025 | CVE Modified | CISA-ADP |
| May 19, 2025 | New CVE Received | [email protected] |