CVE-2025-23165

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Impact: * This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.

Impact:

• This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.(CVE-2025-23165)

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.(CVE-2025-23166)

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.

Impact:

• This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.(CVE-2025-23165)

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.(CVE-2025-23166)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

• nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Impact: * This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.

Impact:

• This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.

Impact:

• This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.

Impact:

• This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.

Impact:

• This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.

Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. (CVE-2025-23165) Improper error handling in async cryptographic operations crashes process. (CVE-2025-23166) Improper HTTP header block termination in llhttp. (CVE-2025-23167)

These are all security issues fixed in the corepack22-22.15.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2025-23165 in the rootio-nodejs package for Root:Debian:12. Multiple fixed versions available.

This update for nodejs22 fixes the following issues:

Update to version 22.15.1.

Security issues fixed:

• CVE-2025-23166: remotely triggerable process crash due to improper error handling in async cryptographic operations (bsc#1243218).
• CVE-2025-23165: memory leak and unbounded memory growth due to corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string (bsc#1243217).

Other changes and issues fixed:

• Changes from version 22.15.0

  • dns: add TLSA record query and parsing
  • assert: improve partialDeepStrictEqual
  • process: add execve
  • tls: implement tls.getCACertificates()
  • v8: add v8.getCppHeapStatistics() method

• Changes from version 22.14.0

  • fs: allow exclude option in globs to accept glob patterns
  • lib: add typescript support to STDIN eval
  • module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX
  • module: add findPackageJSON util
  • process: add process.ref() and process.unref() methods
  • sqlite: support TypedArray and DataView in StatementSync
  • src: add --disable-sigusr1 to prevent signal i/o thread
  • src,worker: add isInternalWorker
  • test_runner: add TestContext.prototype.waitFor()
  • test_runner: add t.assert.fileSnapshot()
  • test_runner: add assert.register() API
  • worker: add eval ts input

• Build with PIE (bsc#1239949).

• Fix builds with OpenSSL 3.5.0 (bsc#1241050).

This update for nodejs22 fixes the following issues:

Update to version 22.15.1.

Security issues fixed:

• CVE-2025-23166: remotely triggerable process crash due to improper error handling in async cryptographic operations (bsc#1243218).
• CVE-2025-23165: memory leak and unbounded memory growth due to corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string (bsc#1243217).

Other changes and issues fixed:

• Changes from version 22.15.0

  • dns: add TLSA record query and parsing
  • assert: improve partialDeepStrictEqual
  • process: add execve
  • tls: implement tls.getCACertificates()
  • v8: add v8.getCppHeapStatistics() method

• Changes from version 22.14.0

  • fs: allow exclude option in globs to accept glob patterns
  • lib: add typescript support to STDIN eval
  • module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX
  • module: add findPackageJSON util
  • process: add process.ref() and process.unref() methods
  • sqlite: support TypedArray and DataView in StatementSync
  • src: add --disable-sigusr1 to prevent signal i/o thread
  • src,worker: add isInternalWorker
  • test_runner: add TestContext.prototype.waitFor()
  • test_runner: add t.assert.fileSnapshot()
  • test_runner: add assert.register() API
  • worker: add eval ts input

• Build with PIE (bsc#1239949).

• Fix builds with OpenSSL 3.5.0 (bsc#1241050).

This update for nodejs20 fixes the following issues:

Update to 20.19.2:

• CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
• CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).
• CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).

Other bugfixes:

• Build with PIE (bsc#1239949)

This update for nodejs20 fixes the following issues:

Update to 20.19.2:

• CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
• CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).
• CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).

Other bugfixes:

• Build with PIE (bsc#1239949)