CVE-2025-47153: out-of-bounds access in some 32-bit builds of Node.js
Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs20.19.0+dfsg-2i386.deb for Debian GNU/Linux, have an inconsistent offt size (e.g., building on i386 Debian always uses FILEOFFSETBITS=64 for the libuv dynamic library, but uses the FILEOFFSETBITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u2Fixed in 18.20.4+dfsg-1~deb12u3Fixed in 20.19.2+dfsg-1+deb13u2Fixed in 20.19.2+dfsg-1+deb13u3Fixed in 24.21.0+dfsg+~cs24.13.4-1Fixed in 24.22.2+dfsg+~cs24.19.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47153?
CVE-2025-47153 has been categorized as a moderate severity vulnerability due to the inconsistencies in data types that could lead to application errors.
How do I fix CVE-2025-47153?
To fix CVE-2025-47153, ensure you are using the latest versions of Node.js or libuv that address the off_t size inconsistency.
What systems are affected by CVE-2025-47153?
CVE-2025-47153 primarily affects 32-bit systems, particularly Debian GNU/Linux when building the nodejs binary package.
What are the potential impacts of CVE-2025-47153?
The potential impacts of CVE-2025-47153 include undefined behavior and application crashes due to inconsistent off_t sizes.
Is CVE-2025-47153 a remote code execution vulnerability?
CVE-2025-47153 is not classified as a remote code execution vulnerability but can lead to unexpected behaviors in programs that rely on consistent file size handling.