The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-nodejsalma-upgrade-nodejs-develalma-upgrade-nodejs-docsalma-upgrade-nodejs-full-i18nalma-upgrade-nodejs-libsalma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packagingalma-upgrade-nodejs-packaging-bundleralma-upgrade-npmalma-upgrade-v8-12.4-devel | Jun 6, 2025 | May 19, 2025 | |
| Alpine Linux | alpine-linux-upgrade-nodejs | Aug 8, 2025 | May 19, 2025 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-nodejs20amazon-linux-2023-upgrade-nodejs20-debuginfoamazon-linux-2023-upgrade-nodejs20-debugsourceamazon-linux-2023-upgrade-nodejs20-develamazon-linux-2023-upgrade-nodejs20-docsamazon-linux-2023-upgrade-nodejs20-full-i18namazon-linux-2023-upgrade-nodejs20-libsamazon-linux-2023-upgrade-nodejs20-libs-debuginfoamazon-linux-2023-upgrade-nodejs20-npmamazon-linux-2023-upgrade-nodejs22amazon-linux-2023-upgrade-nodejs22-debuginfoamazon-linux-2023-upgrade-nodejs22-debugsourceamazon-linux-2023-upgrade-nodejs22-develamazon-linux-2023-upgrade-nodejs22-docsamazon-linux-2023-upgrade-nodejs22-full-i18namazon-linux-2023-upgrade-nodejs22-libsamazon-linux-2023-upgrade-nodejs22-libs-debuginfoamazon-linux-2023-upgrade-nodejs22-npmamazon-linux-2023-upgrade-v8-11-3-develamazon-linux-2023-upgrade-v8-12-4-devel | Jun 11, 2025 | May 19, 2025 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | May 19, 2025 | |
| Debian | debian-upgrade-nodejsno-fix-debian-deb-package | May 20, 2025 | May 19, 2025 | |
| Oracle_linux | — | oracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-full-i18noracle-linux-upgrade-nodejs-libsoracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-npmoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-nodejs-packaging-bundleroracle-linux-upgrade-npmoracle-linux-upgrade-v8-12-4-devel | Jun 5, 2025 | May 19, 2025 |
| Redhat_linux | redhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-libsredhat-upgrade-nodejs-libs-debuginforedhat-upgrade-nodejs-npmredhat-upgrade-nodejs22-debuginforedhat-upgrade-nodejs22-debugsource | Jun 5, 2025 | May 19, 2025 | |
| Rocky_linux | rocky-upgrade-nodejsrocky-upgrade-nodejs-debuginforocky-upgrade-nodejs-debugsourcerocky-upgrade-nodejs-develrocky-upgrade-nodejs-full-i18nrocky-upgrade-nodejs-libsrocky-upgrade-nodejs-libs-debuginforocky-upgrade-nodejs-npmrocky-upgrade-nodejs22-debuginforocky-upgrade-nodejs22-debugsourcerocky-upgrade-npmrocky-upgrade-v8-12.4-devel | Jul 31, 2025 | Jul 29, 2025 | |
| Suse | — | suse-upgrade-corepack20suse-upgrade-corepack22suse-upgrade-nodejs20suse-upgrade-nodejs20-develsuse-upgrade-nodejs20-docssuse-upgrade-nodejs22suse-upgrade-nodejs22-develsuse-upgrade-nodejs22-docssuse-upgrade-npm20suse-upgrade-npm22 | Dec 5, 2025 | Jun 11, 2025 |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | May 19, 2025 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jul 2, 2025 | May 19, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub