CVE-2025-23166

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published: May 19, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-231676.5A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This in CVE-2025-231688.8The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OTP) delivered via ema CVE-2025-231696.1The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, footer, and logo. However CVE-2025-23177.5The Product Filter by WBW plugin for WordPress is vulnerable to time-based SQL Injection via the filtersDataBackend parameter in all version CVE-2025-231706.7The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the Director shell via S CVE-2025-231717.2The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director does not correctly CVE-2025-231727.2The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP endpoints. However, t CVE-2025-231737.5The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By defa CVE-2025-231747.5CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2025-231756.1Multiple XSS (CWE-79)CVE-2025-231768.8CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-231777.6CWE-427: Uncontrolled Search Path Element