Node.js Vulnerability in SignTraits::DeriveBits() - Remote Crash Risk
Summary
ALPINE-CVE-2025-23166: The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Affects nodejs versions < 22.15.1-r0. Fixed in 22.15.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The affected version, nodejs in Alpine v3.21, is known for its performance and efficiency in handling asynchronous operations. However, it has a vulnerability that can lead to a crash when handling untrusted inputs in cryptographic operations.
Vulnerability Detail
The vulnerability arises from the C++ method SignTraits::DeriveBits(), which may incorrectly invoke ThrowException() when processing user-supplied inputs in a background thread. This flaw can lead to a crash of the Node.js process, especially when dealing with untrusted data. The potential ramifications include service disruption and denial of service, making it critical for applications relying on Node.js to address this issue promptly.
How To Fix
Minimum fixed version
22.15.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted inputs in cryptographic operations until the package can be updated. Implement input validation and sanitization to minimize the risk of triggering the vulnerability.
Conclusion
In summary, the vulnerability in Node.js's SignTraits::DeriveBits() method poses a significant risk of remote crashes due to improper handling of user inputs. It is crucial for users of the affected nodejs package in Alpine v3.21 to update to version 22.15.1-r0 to mitigate this risk. Until then, implementing workarounds such as input validation is advisable.
See every vulnerability recorded for nodejs →
FAQ
The vulnerability is a potential crash of the Node.js process due to improper handling of user inputs in cryptographic operations.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The primary consequence is a denial of service, as the Node.js process may crash when handling untrusted inputs.
Yes, the patched version of the nodejs package is 22.15.1-r0. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, implement input validation and avoid processing untrusted data in cryptographic operations as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
