CVE-2025-23166: Improper error handling in async cryptographic operations crashes process
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.19.2Fixed in 22.15.1Fixed in 23.11.1Fixed in 24.0.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.19.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.15.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.0.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2025-23166?
CVE-2025-23166 has a high severity rating due to the potential for it to crash the Node.js process based on untrusted inputs.
How do I fix CVE-2025-23166?
To fix CVE-2025-23166, update your Node.js installation to the latest version where this vulnerability has been addressed.
What software is affected by CVE-2025-23166?
CVE-2025-23166 affects all versions of Node.js that include the SignTraits::DeriveBits() method.
Can CVE-2025-23166 lead to security risks?
Yes, CVE-2025-23166 can lead to security risks as it may allow adversaries to exploit crashes in cryptographic operations.
What happens if CVE-2025-23166 is exploited?
If CVE-2025-23166 is exploited, it may lead to a denial of service by crashing the Node.js process, impacting application availability.