Critical Vulnerability in Node.js Package: nodejs - Internal Worker Exposure
Summary
UBUNTU-CVE-2025-23083: With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. Affects nodejs versions 20.16.0+dfsg-1ubuntu1 – 20.18.1+dfsg-1ubuntu2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The affected package, nodejs, along with its associated binaries (libnode-dev, libnode115), is integral for running JavaScript applications on Ubuntu systems. This vulnerability exposes internal worker threads, potentially allowing malicious actors to exploit them.
Vulnerability Detail
The vulnerability arises from the diagnostics_channel utility, which enables hooking into events when worker threads are created. This exposure is not limited to user-created workers but also includes internal workers, allowing attackers to access and manipulate their constructors for malicious purposes. This issue affects users operating under the Permission Model in Node.js versions 20, 22, and 23, leading to severe security risks, including unauthorized access and potential data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the Permission Model feature when running Node.js applications. This can be done by avoiding the use of the --permission flag when starting the Node.js process.
Conclusion
In summary, the vulnerability in the Node.js package exposes internal worker threads, posing significant security risks. Users are urged to update their packages to the latest version and consider workarounds to minimize exposure until a full fix is implemented. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 7.7, indicating a high level of severity.
Node.js versions 20, 22, and 23 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to internal worker threads, allowing attackers to exploit them for malicious purposes.
Yes, a patched version of the nodejs package is available. It is recommended to update to this version to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
