https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:12:23 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:8467 <p><strong>Affected:</strong> AlmaLinux:9: nodejs, AlmaLinux:9: nodejs-devel, AlmaLinux:9: nodejs-docs, AlmaLinux:9: nodejs-full-i18n, AlmaLinux:9: nodejs-libs, AlmaLinux:9: nodejs-nodemon, AlmaLinux:9: nodejs-packaging, AlmaLinux:9: nodejs-packaging-bundler, AlmaLinux:9: npm, AlmaLinux:9: v8-12.4-devel</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: nodejs, AlmaLinux:9: nodejs-devel, AlmaLinux:9: nodejs-docs, AlmaLinux:9: nodejs-full-i18n, AlmaLinux:9: nodejs-libs, AlmaLinux:9: nodejs-nodemon, AlmaLinux:9: nodejs-packaging, AlmaLinux:9: nodejs-packaging-bundler, AlmaLinux:9: npm, AlmaLinux:9: v8-12.4-devel</p> <p>Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.</p> <p>Security Fix(es):</p> <p>* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:8467 https://cve.radiocsirt.org/vuln/bdu:2025-10620 bdu:2025-10620 https://cve.radiocsirt.org/vuln/bdu:2025-10620 https://cve.radiocsirt.org/vuln/bell-cve-2025-23166 <p><strong>Affected:</strong> Alpaquita:23: nodejs, Alpaquita:23: openjdk-nik-23-17, Alpaquita:23: openjdk-nik-23-21, Alpaquita:23: openjdk-nik-24-24, Alpaquita:25: openjdk-nik-23-17, Alpaquita:25: openjdk-nik-23-21, Alpaquita:25: openjdk-nik-24-24, Alpaquita:stream: nodejs, Alpaquita:stream: openjdk-nik-23-17, Alpaquita:stream: openjdk-nik-23-21 and 12 more</p> <p><strong>Affected:</strong> Alpaquita:23: nodejs, Alpaquita:23: openjdk-nik-23-17, Alpaquita:23: openjdk-nik-23-21, Alpaquita:23: openjdk-nik-24-24, Alpaquita:25: openjdk-nik-23-17, Alpaquita:25: openjdk-nik-23-21, Alpaquita:25: openjdk-nik-24-24, Alpaquita:stream: nodejs, Alpaquita:stream: openjdk-nik-23-17, Alpaquita:stream: openjdk-nik-23-21 and 12 more</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-23166 https://cve.radiocsirt.org/vuln/bit-node-2025-23166 <p><strong>Affected:</strong> Bitnami: node</p> <p>The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.</p> <p><strong>Affected:</strong> Bitnami: node</p> <p>The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.</p> https://cve.radiocsirt.org/vuln/bit-node-2025-23166 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0434 certfr-2025-avi-0434 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0434 https://cve.radiocsirt.org/vuln/euvd-2026-241464 EUVD-2026-241464 https://cve.radiocsirt.org/vuln/euvd-2026-241464 https://cve.radiocsirt.org/vuln/fkie_cve-2025-23166 <p>The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.</p> <p>The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-23166 https://cve.radiocsirt.org/vuln/ghsa-rrjv-57mm-j6cm <p>The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.</p> <p>The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.</p> https://cve.radiocsirt.org/vuln/ghsa-rrjv-57mm-j6cm https://cve.radiocsirt.org/vuln/msrc_cve-2025-23166 msrc_CVE-2025-23166 https://cve.radiocsirt.org/vuln/msrc_cve-2025-23166 https://cve.radiocsirt.org/vuln/oesa-2025-1533 <p><strong>Affected:</strong> openEuler:24.03-LTS: nodejs</p> <p>Node.js is a platform built on Chrome&amp;amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es):</p> <p>In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.</p> <p>Impact: * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.(CVE-2025-23165)</p> <p>The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.(CVE-2025-23166)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: nodejs</p> <p>Node.js is a platform built on Chrome&amp;amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es):</p> <p>In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.</p> <p>Impact: * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.(CVE-2025-23165)</p> <p>The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.(CVE-2025-23166)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1533 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15250-1 <p>corepack22-22.15.1-1.1 on GA media</p> <p>corepack22-22.15.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15250-1 https://cve.radiocsirt.org/vuln/rhsa-2025:8493 <p>nodejs: Memory Leak in Node.js ReadFileUtf8 Binding Leading to DoS nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js</p> <p>nodejs: Memory Leak in Node.js ReadFileUtf8 Binding Leading to DoS nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js</p> https://cve.radiocsirt.org/vuln/rhsa-2025:8493 https://cve.radiocsirt.org/vuln/suse-su-2025:01878-1 <p>Security update for nodejs22</p> <p>Security update for nodejs22</p> https://cve.radiocsirt.org/vuln/suse-su-2025:01878-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-23166 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: nodejs</p> <p>The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: nodejs</p> <p>The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-23166 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1055 <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um einen Denial of Service Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1055