CVE-2025-23166
published 2025-05-19CVE-2025-23166: The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the…
PriorityP339high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
0.76%
51.4th percentile
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 20.19.2+dfsg-1 (forky) | nodejs 20.19.2+dfsg-1 (forky) |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.* | 14.* |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.* | 16.* |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 18.0 < 18.* | 18.* |
| nodejs | node | >= 19.0 < 19.* | 19.* |
| nodejs | node | 20.0 – 20.19.1 | — |
| nodejs | node | >= 21.0 < 21.* | 21.* |
| nodejs | node | 22.0 – 22.15.0 | — |
| nodejs | node | 23.0 – 23.11.0 | — |
| nodejs | node | 24.0 – 24.0.1 | — |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | nodejs | >= 0 < 20.19.2+dfsg-1 | 20.19.2+dfsg-1 |
| nodejs | nodejs | >= 0 < 20.19.2+dfsg-1 | 20.19.2+dfsg-1 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Java SE Risk Matrix: Node (Node.js) — CVE-2025-23166
vendor_oracle·2025-07-15·CVSS 7.5
CVE-2025-23166 [HIGH] Oracle Oracle Java SE Risk Matrix: Node (Node.js) — CVE-2025-23166
Oracle Oracle Java SE Risk Matrix: Node (Node.js) vulnerability
CVE: CVE-2025-23166
CVSS: 7.5
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2025 (JUL 2025)
Red Hat
nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js
vendor_redhat·2025-05-19·CVSS 7.5
CVE-2025-23166 [HIGH] CWE-248 nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js
nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
A flaw was found in Node.js, specifically in the C++ method SignTraits::DeriveBits(). This vulnerability can allow a remote attacker to crash the Node.js runtime via untrusted input, triggering an exception in a background thread.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of
Debian
CVE-2025-23166: nodejs - The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() ba...
vendor_debian·2025·CVSS 7.5
CVE-2025-23166 [HIGH] CVE-2025-23166: nodejs - The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() ba...
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
Scope: local
bookworm: open
bullseye: resolved
forky: resolved (fixed in 20.19.2+dfsg-1)
sid: resolved (fixed in 20.19.2+dfsg-1)
trixie: resolved (fixed in 20.19.2+dfsg-1)
GHSA
GHSA-rrjv-57mm-j6cm: The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, cra
ghsa_unreviewed·2025-05-19
CVE-2025-23166 [HIGH] CWE-248 GHSA-rrjv-57mm-j6cm: The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, cra
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
OSV
CVE-2025-23166: The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, cra
osv·2025-05-19·CVSS 7.5
CVE-2025-23166 [HIGH] CVE-2025-23166: The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, cra
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-19
Published