CVE-2025-23083

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-23083", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2025-01-10T19:05:52.771Z", "datePublished": "2025-01-22T01:11:30.802Z", "dateUpdated": "2026-02-26T19:08:58.894Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \r\n\r\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23."}], "affected": [{"product": "Node", "vendor": "NodeJS", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "4.0", "status": "affected", "lessThan": "4.*"}, {"versionType": "semver", "version": "5.0", "status": "affected", "lessThan": "5.*"}, {"versionType": "semver", "version": "6.0", "status": "affected", "lessThan": "6.*"}, {"versionType": "semver", "version": "7.0", "status": "affected", "lessThan": "7.*"}, {"versionType": "semver", "version": "8.0", "status": "affected", "lessThan": "8.*"}, {"versionType": "semver", "version": "9.0", "status": "affected", "lessThan": "9.*"}, {"versionType": "semver", "version": "10.0", "status": "affected", "lessThan": "10.*"}, {"versionType": "semver", "version": "11.0", "status": "affected", "lessThan": "11.*"}, {"versionType": "semver", "version": "12.0", "status": "affected", "lessThan": "12.*"}, {"versionType": "semver", "version": "13.0", "status": "affected", "lessThan": "13.*"}, {"versionType": "semver", "version": "14.0", "status": "affected", "lessThan": "14.*"}, {"versionType": "semver", "version": "15.0", "status": "affected", "lessThan": "15.*"}, {"versionType": "semver", "version": "16.0", "status": "affected", "lessThan": "16.*"}, {"versionType": "semver", "version": "17.0", "status": "affected", "lessThan": "17.*"}, {"versionType": "semver", "version": "19.0", "status": "affected", "lessThan": "19.*"}, {"versionType": "semver", "version": "20.0", "status": "affected", "lessThan": "20.18.2"}, {"versionType": "semver", "version": "21.0", "status": "affected", "lessThan": "21.*"}, {"versionType": "semver", "version": "22.0", "status": "affected", "lessThan": "22.13.1"}, {"versionType": "semver", "version": "23.0", "status": "affected", "lessThan": "23.6.1"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 7.7, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-04-30T22:25:22.434Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23083", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-28T04:55:27.327533Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T19:08:58.894Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-07-22T15:23:52.842Z"}, "references": [{"url": "https://security.netapp.com/advisory/ntap-20250228-0008/"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-23083-detect-nodejs-vulnerability"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-23083-mitigate-nodejs-vulnerability"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://security.netapp.com/advisory/ntap-20250228-0008/"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-23083-detect-nodejs-vulnerability"}, {"url": "https://www.vicarius.io/vsociety/posts/cve-2025-23083-mitigate-nodejs-vulnerability"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-07-22T15:23:52.842Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23083", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-28T04:55:27.327533Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-06T14:09:03.361Z"}}], "cna": {"metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "affected": [{"vendor": "NodeJS", "product": "Node", "versions": [{"status": "affected", "version": "4.0", "lessThan": "4.*", "versionType": "semver"}, {"status": "affected", "version": "5.0", "lessThan": "5.*", "versionType": "semver"}, {"status": "affected", "version": "6.0", "lessThan": "6.*", "versionType": "semver"}, {"status": "affected", "version": "7.0", "lessThan": "7.*", "versionType": "semver"}, {"status": "affected", "version": "8.0", "lessThan": "8.*", "versionType": "semver"}, {"status": "affected", "version": "9.0", "lessThan": "9.*", "versionType": "semver"}, {"status": "affected", "version": "10.0", "lessThan": "10.*", "versionType": "semver"}, {"status": "affected", "version": "11.0", "lessThan": "11.*", "versionType": "semver"}, {"status": "affected", "version": "12.0", "lessThan": "12.*", "versionType": "semver"}, {"status": "affected", "version": "13.0", "lessThan": "13.*", "versionType": "semver"}, {"status": "affected", "version": "14.0", "lessThan": "14.*", "versionType": "semver"}, {"status": "affected", "version": "15.0", "lessThan": "15.*", "versionType": "semver"}, {"status": "affected", "version": "16.0", "lessThan": "16.*", "versionType": "semver"}, {"status": "affected", "version": "17.0", "lessThan": "17.*", "versionType": "semver"}, {"status": "affected", "version": "19.0", "lessThan": "19.*", "versionType": "semver"}, {"status": "affected", "version": "20.0", "lessThan": "20.18.2", "versionType": "semver"}, {"status": "affected", "version": "21.0", "lessThan": "21.*", "versionType": "semver"}, {"status": "affected", "version": "22.0", "lessThan": "22.13.1", "versionType": "semver"}, {"status": "affected", "version": "23.0", "lessThan": "23.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases"}], "descriptions": [{"lang": "en", "value": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \r\n\r\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-04-30T22:25:22.434Z"}}}, "cveMetadata": {"cveId": "CVE-2025-23083", "state": "PUBLISHED", "dateUpdated": "2026-02-26T19:08:58.894Z", "dateReserved": "2025-01-10T19:05:52.771Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2025-01-22T01:11:30.802Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Node", "vendor": "NodeJS", "versions": [{"lessThan": "4.*", "status": "affected", "version": "4.0", "versionType": "semver"}, {"lessThan": "5.*", "status": "affected", "version": "5.0", "versionType": "semver"}, {"lessThan": "6.*", "status": "affected", "version": "6.0", "versionType": "semver"}, {"lessThan": "7.*", "status": "affected", "version": "7.0", "versionType": "semver"}, {"lessThan": "8.*", "status": "affected", "version": "8.0", "versionType": "semver"}, {"lessThan": "9.*", "status": "affected", "version": "9.0", "versionType": "semver"}, {"lessThan": "10.*", "status": "affected", "version": "10.0", "versionType": "semver"}, {"lessThan": "11.*", "status": "affected", "version": "11.0", "versionType": "semver"}, {"lessThan": "12.*", "status": "affected", "version": "12.0", "versionType": "semver"}, {"lessThan": "13.*", "status": "affected", "version": "13.0", "versionType": "semver"}, {"lessThan": "14.*", "status": "affected", "version": "14.0", "versionType": "semver"}, {"lessThan": "15.*", "status": "affected", "version": "15.0", "versionType": "semver"}, {"lessThan": "16.*", "status": "affected", "version": "16.0", "versionType": "semver"}, {"lessThan": "17.*", "status": "affected", "version": "17.0", "versionType": "semver"}, {"lessThan": "19.*", "status": "affected", "version": "19.0", "versionType": "semver"}, {"lessThan": "20.18.2", "status": "affected", "version": "20.0", "versionType": "semver"}, {"lessThan": "21.*", "status": "affected", "version": "21.0", "versionType": "semver"}, {"lessThan": "22.13.1", "status": "affected", "version": "22.0", "versionType": "semver"}, {"lessThan": "23.6.1", "status": "affected", "version": "23.0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \r\n\r\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23."}, {"lang": "es", "value": "Con la ayuda de la utilidad diagnostics_channel, se puede conectar un evento cada vez que se crea un subproceso de trabajo. Esto no se limita solo a los trabajadores, sino que tambi\u00e9n expone a los trabajadores internos, donde se puede obtener una instancia de ellos y se puede obtener su constructor y restablecerlo para un uso malintencionado. Esta vulnerabilidad afecta a los usuarios del modelo de permisos (--permission) en Node.js v20, v22 y v23."}], "id": "CVE-2025-23083", "lastModified": "2026-06-17T08:51:52.600", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "support@hackerone.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-23083", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-01-28T04:55:27.327533Z", "version": "2.0.3"}}]}, "published": "2025-01-22T02:15:33.930", "references": [{"source": "support@hackerone.com", "url": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20250228-0008/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.vicarius.io/vsociety/posts/cve-2025-23083-detect-nodejs-vulnerability"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.vicarius.io/vsociety/posts/cve-2025-23083-mitigate-nodejs-vulnerability"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:1351", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "nodejs:20-8100020250203134842.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-02-12T00:00:00Z"}, {"advisory": "RHSA-2025:1611", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "nodejs:22-8100020250130144944.6d880403", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-02-17T00:00:00Z"}, {"advisory": "RHSA-2025:1443", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "nodejs:20-9050020250130114516.rhel9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-02-13T00:00:00Z"}, {"advisory": "RHSA-2025:1613", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "nodejs:22-9050020250131131518.rhel9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-02-17T00:00:00Z"}, {"advisory": "RHSA-2025:1522", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "nodejs:20-9040020250211134231.rhel9", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-02-17T00:00:00Z"}], "bugzilla": {"description": "nodejs: Node.js Worker Thread Exposure via Diagnostics Channel", "id": "2339392", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339392"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-863", "details": ["With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.", "A flaw was found in the Node.js diagnostics_channel. This vulnerability allows an attacker to reinstate and misuse worker constructors, potentially bypassing the Permission Model via hooking into events when a worker thread is created."], "name": "CVE-2025-23083", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "nodejs22", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs:18/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "nodejs:18/nodejs", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-01-22T01:11:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-23083\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-23083\nhttps://nodejs.org/en/blog/vulnerability/january-2025-security-releases"], "statement": "This vulnerability is rated as an Important severity because the diagnostics_channel utility, allowing attackers to hook into events triggered when a worker thread is created. This not only exposes user-defined workers but also internal workers, enabling the attacker to retrieve instances and potentially capture and reinstate their constructors for malicious purposes.", "threat_severity": "Important"}

{}