With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
CVSS Details
- CVSS 3.0 Base Score: 7.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade v8-12.4-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade npm | Feb 20, 2025 | Jan 22, 2025 |
| Alpine Linux | — | Upgrade openjdk17Upgrade nodejsUpgrade openjdk21 | Aug 8, 2025 | Jan 22, 2025 |
| Amazon_linux_2023 | — | Upgrade v8-11.3-develUpgrade nodejs20-debuginfoUpgrade nodejs20-develUpgrade nodejs20-docsUpgrade nodejs20-debugsourceUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-npmUpgrade nodejs20-full-i18nUpgrade nodejs20Upgrade nodejs20-libs | Feb 17, 2025 | Jan 22, 2025 |
| Debian | — | Upgrade nodejsNo solution exists | May 15, 2025 | Jan 22, 2025 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Jun 13, 2025 | Jan 22, 2025 |
| Oracle_linux | — | Upgrade v8-12.4-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs | Feb 14, 2025 | Jan 22, 2025 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-nodemonUpgrade v8-12.4-develUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-full-i18n | Feb 13, 2025 | Jan 22, 2025 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade v8-12.4-develUpgrade nodejs-devel | Feb 14, 2025 | Jan 22, 2025 |
| Suse | — | Upgrade nodejs22Upgrade corepack20Upgrade nodejs20-develUpgrade nodejs22-docsUpgrade nodejs20-docsUpgrade npm20Upgrade npm22Upgrade corepack22Upgrade nodejs20Upgrade nodejs22-devel | Jan 27, 2025 | Jan 22, 2025 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jan 22, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jan 22, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub