CVE-2025-47153: out-of-bounds access in some 32-bit builds of Node.js
First published: Thu May 01 2025(Updated: )
Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-1_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Node.js |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=892601
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922075
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076350
- https://github.com/nodejs/node-v0.x-archive/issues/4549
- http://www.openwall.com/lists/oss-security/2025/05/02/2
- https://lists.debian.org/debian-lts-announce/2025/05/msg00003.html
Frequently Asked Questions
What is the severity of CVE-2025-47153?
CVE-2025-47153 has been categorized as a moderate severity vulnerability due to the inconsistencies in data types that could lead to application errors.
How do I fix CVE-2025-47153?
To fix CVE-2025-47153, ensure you are using the latest versions of Node.js or libuv that address the off_t size inconsistency.
What systems are affected by CVE-2025-47153?
CVE-2025-47153 primarily affects 32-bit systems, particularly Debian GNU/Linux when building the nodejs binary package.
What are the potential impacts of CVE-2025-47153?
The potential impacts of CVE-2025-47153 include undefined behavior and application crashes due to inconsistent off_t sizes.
Is CVE-2025-47153 a remote code execution vulnerability?
CVE-2025-47153 is not classified as a remote code execution vulnerability but can lead to unexpected behaviors in programs that rely on consistent file size handling.
- collector/mitre-cve
- source/MITRE
- agent/type
- agent/first-publish-date
- agent/author
- agent/weakness
- agent/severity
- agent/description
- agent/references
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/event
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-47153
- agent/title
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- vendor/node.js
- canonical/node.js