Critical Background Thread Vulnerability in Node.js - CVE-2025-23166
Summary
CVE-2025-23166: The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Affects nodejs versions < 22.15.1-r0. Fixed in 22.15.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source, cross-platform JavaScript runtime environment that executes JavaScript code outside a web browser. It is widely used for building scalable network applications. The vulnerability in question arises from the C++ method SignTraits::DeriveBits(), which can lead to process crashes when handling untrusted inputs in background threads.
Vulnerability Detail
The vulnerability, identified as CVE-2025-23166, stems from an improper call to ThrowException() within the SignTraits::DeriveBits() method. This flaw can be exploited by an adversary to crash the Node.js process by supplying malicious inputs during cryptographic operations. The risk is particularly pronounced in environments where Node.js is handling untrusted data, making it a significant concern for developers and system administrators.
How To Fix
Minimum fixed version
22.15.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider validating and sanitizing all user inputs before processing them in background threads. This can help mitigate the risk of crashing the Node.js process. Implementing strict input validation can prevent malicious data from being processed.
Conclusion
CVE-2025-23166 presents a significant risk to Node.js applications, particularly those processing untrusted inputs. It is crucial to update to the latest patched version of Node.js and implement input validation to mitigate potential risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for nodejs →
FAQ
CVE-2025-23166 is a vulnerability in Node.js that can lead to process crashes when handling untrusted inputs in background threads.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, ensure that all user inputs are validated and sanitized to reduce the risk of exploitation.
Yes, the vulnerability affects all versions of Node.js prior to the patched version that addresses CVE-2025-23166.
More information can be found in the official CVE database and security advisories related to Node.js.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
