CVE-2025-23083
Node.js: permission model bypass via internal worker leak in diagnostics_channel
Technology
Node.js
CVSS Score
7.7 / 10.0
Affected Versions
Node.js 20, 22 and 23 with the permission model enabled
Upstream Fix
20.18.2; 22.13.1; 23.6.1
Published
January 22, 2025
OSSeva Coverage
Fixed upstream
Description
With diagnostics_channel, an event can be hooked whenever a worker thread is created, including internal workers, whose constructor can then be reused maliciously. Affects permission model users on Node.js 20, 22 and 23. Rated High by Node.js. Fixed in the January 2025 security releases: 20.18.2, 22.13.1 and 23.6.1.
Is your Node.js deployment affected?
If you're running Node.js 20, 22 and 23 with the permission model enabled, you need this patch. Book a discovery call to get covered.
Get a quote
Running Node.js Node.js 20, 22 and 23 with the permission model enabled?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?