ALPINE-CVE-2025-23083
ALPINE-CVE-2025-23083
This page contains facts from public vulnerability sources. Check the original advisory before updating.
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
CVSS 7.7 · High · Fix available
- Published
- Updated
Stack: system
Affected products and versions
nodejs Alpine:v3.21
- Affected ranges
- ECOSYSTEM: < 22.13.1-r0
Update to 22.13.1-r0
nodejs Alpine:v3.22
- Affected ranges
- ECOSYSTEM: < 22.13.1-r0
Update to 22.13.1-r0
nodejs Alpine:v3.23
- Affected ranges
- ECOSYSTEM: < 22.13.1-r0
Update to 22.13.1-r0
nodejs Alpine:v3.24
- Affected ranges
- ECOSYSTEM: < 22.13.1-r0
Update to 22.13.1-r0