p PatchFirst

CVE-2025-23083

CVE-2025-23083

This page contains facts from public vulnerability sources. Check the original advisory before updating.

With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.

CVSS 7.7 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node.js

    Versions
    • ≥ 4.0, < 4.*: Affected (semver)
    • ≥ 5.0, < 5.*: Affected (semver)
    • ≥ 6.0, < 6.*: Affected (semver)
    • ≥ 7.0, < 7.*: Affected (semver)
    • ≥ 8.0, < 8.*: Affected (semver)
    • ≥ 9.0, < 9.*: Affected (semver)
    • ≥ 10.0, < 10.*: Affected (semver)
    • ≥ 11.0, < 11.*: Affected (semver)
    • ≥ 12.0, < 12.*: Affected (semver)
    • ≥ 13.0, < 13.*: Affected (semver)
    • ≥ 14.0, < 14.*: Affected (semver)
    • ≥ 15.0, < 15.*: Affected (semver)
    • ≥ 16.0, < 16.*: Affected (semver)
    • ≥ 17.0, < 17.*: Affected (semver)
    • ≥ 19.0, < 19.*: Affected (semver)
    • ≥ 20.0, < 20.18.2: Affected (semver)
    • ≥ 21.0, < 21.*: Affected (semver)
    • ≥ 22.0, < 22.13.1: Affected (semver)
    • ≥ 23.0, < 23.6.1: Affected (semver)

    Update to 20.18.2; Update to 22.13.1; Update to 23.6.1

  • nodejs Debian:13

    Affected ranges
    • ECOSYSTEM: < 20.18.2+dfsg-1

    Update to 20.18.2+dfsg-1

  • nodejs Debian:14

    Affected ranges
    • ECOSYSTEM: < 20.18.2+dfsg-1

    Update to 20.18.2+dfsg-1

Original sources

Check your server →