Critical Security Update for Node.js: Remote Crash Vulnerability
Summary
ALSA-2025:8493: Important: nodejs22 security update. Affects nodejs versions < 1:22.16.0-1.el10_0. Fixed in 1:22.16.0-1.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a powerful platform built on Chrome's JavaScript runtime, designed for building fast and scalable network applications. It employs an event-driven, non-blocking I/O model, making it lightweight and efficient for data-intensive real-time applications that operate across distributed devices. However, vulnerabilities can arise, impacting the stability and security of applications built on this platform.
Vulnerability Detail
The vulnerability identified as CVE-2025-23166 allows for a remote crash via the SignTraits::DeriveBits() function in Node.js. This issue can lead to application instability, potentially causing denial of service (DoS) conditions if exploited by an attacker. The vulnerability stems from improper handling of certain inputs, which can be manipulated to trigger a crash in the Node.js runtime.
How To Fix
Minimum fixed version
1:22.16.0-1.el10_0
This is the first release that contains the fix.
sudo dnf update nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate updating is not feasible, consider implementing input validation to mitigate the risk of triggering the vulnerability until the update can be applied.
Conclusion
In summary, the CVE-2025-23166 vulnerability in Node.js poses a significant risk of remote crashes, which can disrupt application availability. It is crucial to update to the patched version to mitigate this risk. For real-time monitoring of open-source vulnerabilities, consider using Vulert, which can alert you to issues without requiring code access.
See every vulnerability recorded for nodejs →
FAQ
CVE-2025-23166 is a vulnerability in Node.js that allows for a remote crash via the SignTraits::DeriveBits() function.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application crashes and denial of service, affecting the availability of your services.
Yes, a patch is available in the form of updated packages. Ensure you update to version 1:22.16.0-1.el10_0 or later.
If you cannot update immediately, implement input validation as a temporary workaround to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
