CVE-2025-47153 Details
Description
Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.
A vulnerability has been identified in certain build processes of Node.js and its dependency Libuv for 32-bit systems, specifically in the Node.js binary package version 20.19.0+dfsg-2 for Debian GNU/Linux. The issue arises from an inconsistent off_t size, where Libuv is built with _FILE_OFFSET_BITS=64, but Node.js defaults to 32. This mismatch leads to out-of-bounds access, causing a segmentation fault. The problem is not present in the Node.js version 20.19.0 when it is built with the upstream-bundled Libuv 1.46.0.
The vulnerability has been fixed in Node.js version 20.19.0+dfsg1-1, which is available in the Debian unstable repository. Users can upgrade to this version to address the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 1, 2025CISA-ADP
Assessed May 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2025/05/msg00003.html | CVE | AdvisoryMailing ListRemedyVendor |
| http://www.openwall.com/lists/oss-security/2025/05/02/2 | CVE | Mailing ListTechnical Description |
| https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076350 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922075 | [email protected] | |
| https://bugzilla.redhat.com/show_bug.cgi?id=892601 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/nodejs/node-v0.x-archive/issues/4549 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1102 | Reliance on Machine-Dependent Data Representation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libuv | >= 1.44.0, < 1.44.2-1 (semver) |
CPE
Remediation
| |
| Node.js | 18.19.0+dfsg-6~deb12u2 20.19.0+dfsg-2 (semver) |
CPE
Remediation
| |
| Debian | < 12.22.12~dfsg-1~deb11u7 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 2, 2025 | CVE Modified | CVE |
| May 2, 2025 | CVE Modified | CVE |
| May 1, 2025 | CVE Modified | [email protected] |
| May 1, 2025 | CVE Modified | [email protected] |
| May 1, 2025 | New CVE Received | [email protected] |