CVE-2025-23090
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker...
CVE-2025-23090 has been rejected by its source and should not be treated as a live vulnerability, published January 22, 2025. Fixed in node 20.18.2.
- Severity
- 7.7 HighCVSS 3.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
20.18.2node +1 more
Description
This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected products
Affected packages
What each source reports
GitHub Advisories Score usedGHSA-5vvm-wqc8-r5m8
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker...
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage.
This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
- Record
GHSA-5vvm-wqc8-r5m8- CVSS 3.0
- 7.7 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE ListNo score
This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.
- Record
CVE-2025-23090- Updated
- 2026-11-02
EUVDEUVD-2025-3118
This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.
- Record
EUVD-2025-3118- CVSS
- 0.0 None
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
NVDNo score
Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.
- Record
CVE-2025-23090- Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-23090
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
- Record
UBUNTU-CVE-2025-23090- CVSS 3.0
- 7.7 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVBIT-node-2025-23090No score
Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.
- Record
BIT-node-2025-23090- Updated
- 2026-11-02
OSVBIT-node-min-2025-23090No score
Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.
- Record
BIT-node-min-2025-23090- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.