https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:24:15 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:1351 <p><strong>Affected:</strong> AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: nodejs-packaging-bundler, AlmaLinux:8: npm</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* undici: Undici Uses Insufficiently Random Values (CVE-2025-22150) * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083) * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: nodejs, AlmaLinux:8: nodejs-devel, AlmaLinux:8: nodejs-docs, AlmaLinux:8: nodejs-full-i18n, AlmaLinux:8: nodejs-nodemon, AlmaLinux:8: nodejs-packaging, AlmaLinux:8: nodejs-packaging-bundler, AlmaLinux:8: npm</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* undici: Undici Uses Insufficiently Random Values (CVE-2025-22150) * nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083) * nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:1351 https://cve.radiocsirt.org/vuln/bdu:2025-03339 bdu:2025-03339 https://cve.radiocsirt.org/vuln/bdu:2025-03339 https://cve.radiocsirt.org/vuln/bell-cve-2025-23083 <p><strong>Affected:</strong> Alpaquita:stream: nodejs, BellSoft Hardened Containers:stream: nodejs</p> <p><strong>Affected:</strong> Alpaquita:stream: nodejs, BellSoft Hardened Containers:stream: nodejs</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-23083 https://cve.radiocsirt.org/vuln/bit-node-2025-23083 <p><strong>Affected:</strong> Bitnami: node</p> <p>With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.</p> <p><strong>Affected:</strong> Bitnami: node</p> <p>With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.</p> https://cve.radiocsirt.org/vuln/bit-node-2025-23083 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0060 certfr-2025-avi-0060 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0060 https://cve.radiocsirt.org/vuln/euvd-2026-273299 EUVD-2026-273299 https://cve.radiocsirt.org/vuln/euvd-2026-273299 https://cve.radiocsirt.org/vuln/fkie_cve-2025-23083 <p>With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.</p> <p>With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-23083 https://cve.radiocsirt.org/vuln/ghsa-wv7p-rjf3-9fr5 <p>With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage.</p> <p>This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.</p> <p>With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage.</p> <p>This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.</p> https://cve.radiocsirt.org/vuln/ghsa-wv7p-rjf3-9fr5 https://cve.radiocsirt.org/vuln/msrc_cve-2025-23083 msrc_CVE-2025-23083 https://cve.radiocsirt.org/vuln/msrc_cve-2025-23083 https://cve.radiocsirt.org/vuln/oesa-2025-1234 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: nodejs</p> <p>Node.js is a platform built on Chrome&amp;amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es):</p> <p>With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.(CVE-2025-23083)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: nodejs</p> <p>Node.js is a platform built on Chrome&amp;amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es):</p> <p>With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.(CVE-2025-23083)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1234 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14706-1 <p>corepack22-22.13.0-1.1 on GA media</p> <p>corepack22-22.13.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14706-1 https://cve.radiocsirt.org/vuln/rhsa-2025:1522 <p>nodejs: Node.js Worker Thread Exposure via Diagnostics Channel</p> <p>nodejs: Node.js Worker Thread Exposure via Diagnostics Channel</p> https://cve.radiocsirt.org/vuln/rhsa-2025:1522 https://cve.radiocsirt.org/vuln/suse-su-2025:0232-1 <p>Security update for nodejs20</p> <p>Security update for nodejs20</p> https://cve.radiocsirt.org/vuln/suse-su-2025:0232-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-23083 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:25.04: nodejs</p> <p>With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:25.04: nodejs</p> <p>With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-23083 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0156 <p>Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, einen Denial-of-Service-Zustand herbeizuführen oder nicht näher spezifizierte Angriffe zu starten.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen preiszugeben, einen Denial-of-Service-Zustand herbeizuführen oder nicht näher spezifizierte Angriffe zu starten.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0156