CVE-2025-27209: HashDoS in V8
The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.
This vulnerability affects Node.js v24.x users.
Other sources
The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.
While the V8 team does not classify this as a security vulnerability, the Node.js project considers it one due to its potential impact in real-world scenarios.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.4.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2025-27209?
CVE-2025-27209 is classified as a medium severity vulnerability due to its potential for causing denial of service through hash collisions.
How do I fix CVE-2025-27209?
To fix CVE-2025-27209, upgrade Node.js to the latest version where the hashing algorithm has been addressed.
What type of vulnerability is CVE-2025-27209?
CVE-2025-27209 is a HashDoS vulnerability resulting from changes in string hash computation.
Who is affected by CVE-2025-27209?
CVE-2025-27209 affects all users running Node.js version 24.0.0 and earlier who are using the V8 engine.
Can attackers exploit CVE-2025-27209 remotely?
Yes, attackers can exploit CVE-2025-27209 remotely if they can control the strings that are being hashed.