CVE-2025-27209
Node.js 24: HashDoS reintroduced by V8 string hashing change
Technology
Node.js
CVSS Score
7.5 / 10.0
Affected Versions
Node.js 24 before 24.4.1
Upstream Fix
24.4.1
Published
July 18, 2025
OSSeva Coverage
Fixed upstream
Description
The V8 release in Node.js 24.0.0 changed string hashing to rapidhash, which reintroduced HashDoS: an attacker who controls the strings being hashed can generate many collisions without knowing the hash seed. Affects Node.js 24 only. Rated High by Node.js. Fixed in 24.4.1.
Is your Node.js deployment affected?
If you're running Node.js 24 before 24.4.1, you need this patch. Book a discovery call to get covered.
Get a quote
Running Node.js Node.js 24 before 24.4.1?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?