{"id":"VND-nodejs-may-2025-security-releases","kind":"vulnerability","aliases":[],"related":["CVE-2025-23165","CVE-2025-23166","CVE-2025-23167"],"title":"Node.js: Wednesday, May 14, 2025 Security Releases","description":"Commercial support for versions past the Maintenance LTS phase is available through our OpenJS Ecosystem Sustainability Program partners Wednesday, May 14, 2025 Security Releases TNJP The Node.js Project Wednesday, May 14, 2025 Security Releases Security releases available\nUpdates are now available for the 24.x, 23.x, 22.x, 20.x Node.js release lines for the\nfollowing issues.\nImproper error handling in async cryptographic operations crashes process (CVE-2025-23166) - (high)\nThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException()\nbased on user-supplied inputs when executing in a background thread, crashing the Node.js process.\nSuch cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism\npotentially allows an adversary to remotely crash a Node.js runtime.\nImpact:\nThis vulnerability affects all users in active release lines: 20.x, 22.x, 23.x, 24.x\nThank you, @panva and @tniessen, for reporting and fixing this vulnerability.\nImproper HTTP header block termination in llhttp (CVE-2025-23167) - (medium)\nA flaw in Node.js 20&#x27;s HTTP parser allows improper termination of HTTP/1 headers using \\r\\n\\rX instead of the required \\r\\n\\r\\n .\nThis inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.\nThe issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.\nImpact:\nThis vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.\nThank you, to kenballus for reporting this vulnerability and thank you RafaelGSS for fixing it.\nCorrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo&lt;Value&gt;&amp; args) when args[0] is a string. (CVE-2025-23165) - (low)\nIn Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file : a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\nImpact:\nThis vulnerability affects Windows systems relying on the ReadFileUtf8 API on Node.js release lines: v20 and v22.\nThank you, to Justin Nietzel for reporting and fixing this vulnerability.\nDownloads and release details\nNode.js v20.19.2\nNode.js v22.15.1\nNode.js v23.11.1\nNode.js v24.0.2\nSummary\nThe Node.js project will release new versions of the 24.x, 23.x, 22.x, 20.x\nreleases lines on or shortly after, Wednesday, May 14, 2025 in order to address:\n1 high severity issues.\n1 medium severity issues.\n1 low severity issues.\nImpact\nThe 24.x release line of Node.js is vulnerable to 1 high severity issues.\nThe 23.x release line of Node.js is vulnerable to 1 high severity issues.\nThe 22.x release line of Node.js is vulnerable to 1 low severity issues, 1 high severity issues.\nThe 20.x release line of Node.js is vulnerable to 1 low severity issues, 1 high severity issues, 1 medium severity issues.\nIt&#x27;s important to note that End-of-Life versions are always affected when a security release occurs.\nTo ensure your system&#x27;s security, please use an up-to-date version as outlined in our\nRelease Schedule .\nRelease timing\nReleases will be available on, or shortly after, Wednesday, May 14, 2025.\nContact and future updates\nThe current Node.js security policy can be found at https://nodejs.org/en/security/ .\nPlease follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.\nSubscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. Previous Tuesday, July 15, 2025 Security Releases Next Node.js Test CI Security Incident","summary":"A flaw in SignTraits::DeriveBits() can throw an exception from a background thread based on user-supplied input, crashing the Node.js process (CVE-2025-23166, high). The May 2025 releases also fix an llhttp header-termination bug enabling request smuggling on Node.js 20 and a Windows memory leak in ReadFileUtf8 (CVE-2025-23167 medium, CVE-2025-23165 low).","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node","fixed":["20.19.2"],"affected":">= 20.0.0, < 20.19.2","ecosystem":"node"},{"name":"node","fixed":["22.15.1"],"affected":">= 22.0.0, < 22.15.1","ecosystem":"node"},{"name":"node","fixed":["23.11.1"],"affected":">= 23.0.0, < 23.11.1","ecosystem":"node"},{"name":"node","fixed":["24.0.2"],"affected":">= 24.0.0, < 24.0.2","ecosystem":"node"}],"ecosystems":["node"],"tags":["node","node.js","runtime","self-hosted","windows"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Run `node --version` and compare against the fixed lines: `20.19.2`, `22.15.1`, `23.11.1`, `24.0.2`.\n- Check whether the app uses async crypto operations such as `crypto.subtle` or `crypto` functions on untrusted input.\n- For the llhttp issue, check whether the Node.js 20 HTTP server sits behind a proxy that enforces access controls.","fix":"- Upgrade Node.js to `20.19.2` on the 20.x line, `22.15.1` on 22.x, `23.11.1` on 23.x, or `24.0.2` on 24.x.\n- End-of-Life versions are always affected and receive no fix; move them to a supported release line.","status":"open","published_at":"2025-05-14T03:00:00+00:00","first_seen_at":"2026-10-23T19:13:00+00:00","triaged_at":"2026-10-25T05:39:26+00:00","updated_at":"2026-10-25T05:39:26+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-25T05:39:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Node.js to `20.19.2` on the 20.x line, `22.15.1` on 22.x, `23.11.1` on 23.x, or `24.0.2` on 24.x.\n- End-of-Life versions are always affected and receive no fix; move them to a supported release line.","reach":"internet","title":"Node.js: async crypto error handling lets a request crash the process","impact":"low","summary":"A flaw in SignTraits::DeriveBits() can throw an exception from a background thread based on user-supplied input, crashing the Node.js process (CVE-2025-23166, high). The May 2025 releases also fix an llhttp header-termination bug enabling request smuggling on Node.js 20 and a Windows memory leak in ReadFileUtf8 (CVE-2025-23167 medium, CVE-2025-23165 low).","category":"runtime","nicknames":[],"who_cares":["node.js","self-hosted","windows"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attackers crash the Node.js process with crafted crypto input","analyst_note":"","how_to_check":"- Run `node --version` and compare against the fixed lines: `20.19.2`, `22.15.1`, `23.11.1`, `24.0.2`.\n- Check whether the app uses async crypto operations such as `crypto.subtle` or `crypto` functions on untrusted input.\n- For the llhttp issue, check whether the Node.js 20 HTTP server sits behind a proxy that enforces access controls.","needs_analyst":false,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Any server running an affected Node.js release that performs async cryptographic operations on input an outside party can supply can be crashed remotely. The request smuggling issue applies only to Node.js 20.x HTTP servers behind proxies that rely on access controls, and the ReadFileUtf8 leak applies only to Windows systems using that API on v20 and v22.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000842,"input_tokens":4853,"output_tokens":714,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-16':371C '-2025':51B,80B,84B,155C,242C,351C '-23165':85B,352C '-23166':52B,156C '-23167':81B,243C '/en/security/':630C '/forum/#!forum/nodejs-sec':666C '/nodejs/node/blob/master/security.md':639C '0':346C '1':481C,485C,489C,504C,518C,532C,536C,550C,554C,558C '14':4A,107C,117C,475C,613C '15':694C '20':71B,136C,215C,249C,310C,465C,541C '2025':5A,12A,56B,108C,118C,476C,614C,695C '22':134C,217C,463C,523C '23':132C,219C,461C,509C '24':130C,221C,459C,495C '9':298C 'access':283C 'activ':212C 'address':480C 'adversari':198C 'affect':208C,307C,411C,575C 'alloc':375C 'allow':196C,253C,276C 'also':58B 'alway':574C 'announc':656C 'announcement-on':655C 'api':418C 'appli':188C 'arg':343C,345C 'async':149C 'attack':277C 'avail':97C,123C,127C,606C 'background':38B,177C 'base':40B,167C,282C 'bind':359C 'block':237C 'buffer':373C 'bug':65B 'bypass':279C 'c':159C 'call':165C,394C 'caus':398C 'ci':701C 'commerci':87C 'common':187C 'const':340C 'contact':615C 'control':284C 'correct':301C 'corrupt':334C,365C 'crash':46B,152C,179C,201C 'cryptograph':150C,184C 'current':620C 'cve':50B,79B,83B,154C,241C,350C 'date':593C,671C 'denial':405C 'derivebit':31B,162C 'descriptor':382C 'detail':440C 'download':437C 'due':362C 'ecosystem':101C 'enabl':66B,273C 'end':569C 'end-of-lif':568C 'enforc':300C 'ensur':582C 'error':146C 'everi':393C 'except':35B 'execut':174C 'file':381C 'fix':59B,231C,332C,434C 'flaw':28B,246C 'follow':143C,632C 'found':626C 'fs':338C 'functioncallbackinfo':341C 'futur':617C 'github':689C 'github.com':638C 'github.com/nodejs/node/blob/master/security.md':637C 'groups.google.com':665C 'groups.google.com/forum/#!forum/nodejs-sec':664C 'growth':401C 'handl':147C 'header':63B,236C,258C,302C 'header-termin':62B 'high':53B,157C,482C,505C,519C,537C,555C 'host':25B 'http':235C,251C 'http/1':257C 'impact':205C,304C,408C,493C 'import':564C 'improp':145C,234C,254C 'incid':703C 'inconsist':272C 'incorrect':164C 'input':45B,172C,191C 'instead':263C 'intern':358C 'issu':144C,290C,484C,488C,492C,507C,521C,535C,539C,553C,557C,561C 'juli':693C 'justin':429C 'kenballus':322C 'lead':402C 'leak':76B,360C,391C 'life':571C 'line':140C,214C,422C,468C,498C,512C,526C,544C 'list':662C 'llhttp':61B,240C,295C,316C 'low':86B,353C,490C,533C,551C,653C 'low-volum':652C 'lts':94C 'mail':661C 'maintain':685C 'mainten':93C 'may':3A,11A,55B,106C,116C,163C,474C,612C 'mechan':194C 'medium':82B,244C,486C,559C 'memori':75B,361C,390C,400C 'method':160C 'n':261C,268C,270C 'new':455C 'next':698C 'nietzel':430C 'node':16A,17A,18A,19A,20B,337C 'node.js':1A,21B,48B,70B,113C,138C,181C,203C,248C,309C,355C,420C,441C,443C,445C,447C,451C,500C,514C,528C,546C,621C,648C,681C,699C 'nodej':659C,688C 'nodejs':10A 'nodejs-sec':658C 'nodejs.org':629C 'nodejs.org/en/security/':628C 'note':566C 'occur':580C 'openj':100C 'oper':151C,185C 'order':478C 'organ':690C 'outlin':596C,635C 'overwritten':378C 'panva':225C 'parser':252C 'partner':104C 'past':91C 'path':372C 'phase':95C 'pleas':587C,631C 'pointer':335C,366C 'polici':623C 'potenti':195C 'previous':691C 'prior':313C 'process':49B,153C,182C,634C 'program':103C 'project':114C,452C,684C 'proxi':281C 'proxy-bas':280C 'r':260C,267C,269C 'rafaelgss':330C 'readfileutf8':78B,339C,357C,417C 'relat':678C 'releas':7A,57B,110C,120C,122C,139C,213C,421C,439C,454C,467C,497C,511C,525C,543C,579C,599C,601C,603C,679C,697C 'releases':15A 'reli':414C 'remot':200C 'repeat':395C 'report':229C,324C,432C,644C 'request':67B,274C,288C 'requir':266C 'resolv':292C 'result':386C 'runtim':22B,204C 'rx':262C 'schedul':600C 'sec':660C 'secur':6A,109C,119C,121C,578C,586C,622C,673C,677C,696C,702C 'security':14A 'security-rel':676C 'security-releases':13A 'self':24B 'self-host':23B 'servic':407C 'set':384C 'sever':483C,487C,491C,506C,520C,534C,538C,552C,556C,560C 'short':471C,609C 'signtrait':30B,161C 'smuggl':68B,275C 'stay':668C 'string':349C 'submit':286C 'subscrib':649C 'subsequ':377C 'summari':449C 'suppli':44B,171C 'support':88C 'sustain':102C 'system':413C,584C 'termin':64B,238C,255C,303C 'test':700C 'thank':223C,319C,328C,426C 'thread':39B,178C 'throw':33B 'throwexcept':166C 'thus':192C 'time':602C 'tniessen':227C 'tnjp':111C 'tuesday':692C 'unauthor':287C 'unbound':399C 'unrecover':389C 'untrust':190C 'up-to-d':590C 'updat':124C,618C 'upgrad':294C,318C 'use':259C,396C,588C 'user':43B,170C,210C,312C 'user-suppli':42B,169C 'utf':370C 'uv_fs_s.file':368C 'v20':423C 'v20.19.2':442C 'v22':425C 'v22.15.1':444C 'v23.11.1':446C 'v24.0.2':448C 'v9':317C 'valu':342C 'version':90C,297C,456C,572C,594C 'vnd':9A 'vnd-nodejs-may':8A 'volum':654C 'vulner':207C,233C,306C,326C,410C,436C,502C,516C,530C,548C,646C,674C 'wednesday':2A,105C,115C,473C,611C 'window':26B,74B,412C 'wish':642C 'x':131C,133C,135C,137C,216C,218C,220C,222C,311C,460C,462C,464C,466C,496C,510C,524C,542C","nicknames":[],"mitigations":[],"who_affected":"Any server running an affected Node.js release that performs async cryptographic operations on input an outside party can supply can be crashed remotely. The request smuggling issue applies only to Node.js 20.x HTTP servers behind proxies that rely on access controls, and the ReadFileUtf8 leak applies only to Windows systems using that API on v20 and v22.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-05-14T03:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nodejs","external_id":"may-2025-security-releases","url":"https://nodejs.org/en/blog/vulnerability/may-2025-security-releases","severity":"high","published_at":"2025-05-14T03:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:13:00+00:00","fetched_at":"2026-10-25T20:36:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}