CVE-2025-23166
Node.js: error handling in async cryptographic operations crashes the process
Technology
Node.js
CVSS Score
7.5 / 10.0
Affected Versions
Node.js 20, 22, 23 and 24 before the May 2025 releases
Upstream Fix
20.19.2; 22.15.1; 23.11.1; 24.0.2
Published
May 19, 2025
OSSeva Coverage
Fixed upstream
Description
SignTraits::DeriveBits() could throw an exception from a background thread based on user-supplied input, crashing the Node.js process, so an attacker could remotely crash applications that run cryptographic operations on untrusted input. Rated High by Node.js. Fixed in 20.19.2, 22.15.1, 23.11.1 and 24.0.2. Node.js 18 reached end of life two weeks earlier and was not patched.
Is your Node.js deployment affected?
If you're running Node.js 20, 22, 23 and 24 before the May 2025 releases, you need this patch. Book a discovery call to get covered.
Get a quote
Running Node.js Node.js 20, 22, 23 and 24 before the May 2025 releases?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?