Every CVE Search/ Get API key

CVE-2025-23167

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX`...

6.5 MediumPublic exploitFix available

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact:

  • This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.51%Up 0.5 points since May 19, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.5

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact:

  • This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
Record
CVE-2025-23167
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2025-27706 6.5

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact:

  • This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
Record
EUVD-2025-27706
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hchw-qwx7-4w4c 6.5

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX`...

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact:

  • This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
Record
GHSA-hchw-qwx7-4w4c
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
NVD 6.5

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact:

  • This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
Record
CVE-2025-23167
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
OSVBELL-CVE-2025-23167 6.5
Record
BELL-CVE-2025-23167
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2025-23167 6.5

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination. Impact: * This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.

Record
DEBIAN-CVE-2025-23167
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 17 moreShow less
OSVRHSA-2025:8468 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2025:8468
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:8514 7.5

Red Hat Security Advisory: nodejs:20 security update

Record
RHSA-2025:8514
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:8468 7.5

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:8468
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:8514 7.5

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:8514
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2025:8514 No score

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:8514
Updated
2026-11-06
OSVAZL-61914 No score

CVE-2025-23167 affecting package nodejs 20.14.0-13

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact:

  • This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
Record
AZL-61914
Updated
2026-11-02
OSVAZL-65063 No score

CVE-2025-23167 affecting package nodejs18 18.20.3-11

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact:

  • This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
Record
AZL-65063
Updated
2026-11-02
OSVBIT-node-2025-23167 No score

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact:

  • This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
Record
BIT-node-2025-23167
Updated
2026-11-02
OSVBIT-node-min-2025-23167 No score

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact:

  • This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
Record
BIT-node-min-2025-23167
Updated
2026-11-02
OSVCLSA-2026-1772125283 No score

nodejs: Fix of 4 CVEs

  • CVE-2025-23167: fix improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n.
  • CVE-2025-59466: fix uncatchable stack overflow exceptions when async_hooks are enabled, preventing denial-of-service crashes in applications using AsyncLocalStorage or async_hooks.createHook().
  • CVE-2025-59465: add TLSSocket default error handler to prevent server crash from unhandled ECONNRESET when a malformed HTTP/2 HEADERS frame with invalid HPACK data abruptly destroys a TLS connection during initialization.
  • CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle, preventing exposure of uninitialized memory when buffer allocations are interrupted via the vm module timeout option.
Record
CLSA-2026-1772125283
Updated
2026-11-02
OSV No score

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests.

The issue was resolved by upgrading llhttp to version 9, which enforces correct header termination.

Impact:

  • This vulnerability affects only Node.js 20.x users prior to the llhttp v9 upgrade.
Record
CVE-2025-23167
Updated
2026-11-06
OSVMGASA-2025-0161 No score

Updated nodejs packages fix security vulnerabilities

Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. (CVE-2025-23165) Improper error handling in async cryptographic operations crashes process. (CVE-2025-23166) Improper HTTP header block termination in llhttp. (CVE-2025-23167)

Record
MGASA-2025-0161
Updated
2026-11-02
OSVSUSE-SU-2025:02039-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

Update to 20.19.2:

  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).

Other bugfixes:

  • Build with PIE (bsc#1239949)
Record
SUSE-SU-2025:02039-1
Updated
2026-11-02
OSVSUSE-SU-2025:02045-1 No score

Security update for nodejs20

This update for nodejs20 fixes the following issues:

Update to 20.19.2:

  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).

Other bugfixes:

  • Build with PIE (bsc#1239949)
Record
SUSE-SU-2025:02045-1
Updated
2026-11-02
OSVSUSE-SU-2026:4248-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
  • CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
  • CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
  • CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS…
Record
SUSE-SU-2026:4248-1
Updated
2026-11-02
OSVSUSE-SU-2026:4261-1 No score

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request (bsc#1236258).
  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
  • CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
  • CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
  • CVE-2025-62408: c-ares 1.32.3-1.34.5 use after free() (bsc#1254738).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-9679: undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding (bsc#1268477).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
  • CVE-2026-16728: undici: downstream response desynchronization via retry interceptor (bsc#1273593).
  • CVE-2026-16729: undici: undici's setCookie function does not fully sanitize cookie attributes (bsc#1273591).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-21717: crafted request can lead to hash collisions trivially predictable (bsc#1260494).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48935: Permission Model bypass via FileHandle.utimes() in the promises API (bsc#1268609).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS…
Record
SUSE-SU-2026:4261-1
Updated
2026-11-02
OSVSUSE-SU-2026:4355-1 No score

Security update for nodejs16

This update for nodejs16 fixes the following issues:

  • CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification (bsc#1236250).
  • CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).
  • CVE-2025-23167: llhttp: improper HTTP header block termination in llhttp (bsc#1243220).
  • CVE-2025-55131: timeout-based race conditions allow for allocations that contain leftover data from previous operations and lead to exposure of in-process secrets (bsc#1256570).
  • CVE-2025-59465: malformed HTTP/2 HEADERS frame with invalid HPACK data can cause a crash due to an unhandled error (bsc#1256573).
  • CVE-2025-59466: uncatchable 'Maximum call stack size exceeded' error when async_hooks.createHook() is enabled can lead to crash (bsc#1256574).
  • CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479).
  • CVE-2026-11525: undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (bsc#1268481).
  • CVE-2026-12151: undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (bsc#1268482).
  • CVE-2026-15157: No validation of the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher (bsc#1272958).
  • CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
  • CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
  • CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
  • CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
  • CVE-2026-22036: undici: unbounded decompression chain in HTTP responses via Content-Encoding may lead to resource exhaustion (bsc#1256848).
  • CVE-2026-27135: nghttp2: assertion failure due to missing state validation can lead to DoS (bsc#1259853).
  • CVE-2026-48618: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismatch (bsc#1268593).
  • CVE-2026-48619: Unbounded memory growth in node:http2 clients via attacker-controlled ORIGIN frames (bsc#1268618).
  • CVE-2026-48928: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching (bsc#1268605).
  • CVE-2026-48930: Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings (bsc#1268606).
  • CVE-2026-48931: HTTP Response Queue Poisoning via TOCTOU Race Condition in http.Agent (bsc#1268611).
  • CVE-2026-48933: Node.js WebCrypto AES Integer Overflow Leads to Remote Process Abort (bsc#1268592).
  • CVE-2026-48934: TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections (bsc#1268608).
  • CVE-2026-48937: servers keep accepting data even after sending a GOAWAY frame (bsc#1268555).
  • CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits (bsc#1272941).
  • CVE-2026-56848: HTTP/2 re-entrant send can cause heap-use-after-free (bsc#1272942).
  • CVE-2026-56850: HTTPS Agent can reuse mTLS identities across PFX certificates (bsc#1272944).
  • CVE-2026-58040: HTTPS Agent session reuse can skip hostname verification (bsc#1272945).
  • CVE-2026-58042: dns.resolveAny() can abort on DNS responses with many A records (bsc#1272947).
  • CVE-2026-58044: HTTP parser header truncation can enable request smuggling (bsc#1272951).
  • CVE-2026-58045: node:zlib sync APIs can crash on spoofed TypedArray length (bsc#1272948).
Record
SUSE-SU-2026:4355-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nodejs
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module_el8.10.0+4007+01f7d99b
1:20.19.2-1.module_el8.10.0+4007+01f7d99b
nodejs-devel
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module_el8.10.0+4007+01f7d99b
1:20.19.2-1.module_el8.10.0+4007+01f7d99b
nodejs-docs
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module_el8.10.0+4007+01f7d99b
1:20.19.2-1.module_el8.10.0+4007+01f7d99b
nodejs-full-i18n
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module_el8.10.0+4007+01f7d99b
1:20.19.2-1.module_el8.10.0+4007+01f7d99b
nodejs-nodemon
AlmaLinux:8
From an advisory covering 3 CVEs
 before 3.0.1-1.module_el8.10.0+3982+85c136aa
3.0.1-1.module_el8.10.0+3982+85c136aa
nodejs-packaging
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2021.06-4.module_el8.10.0+3987+dbda4426
2021.06-4.module_el8.10.0+3987+dbda4426
nodejs-packaging-bundler
AlmaLinux:8
From an advisory covering 3 CVEs
 before 2021.06-4.module_el8.10.0+3958+472a6467
2021.06-4.module_el8.10.0+3958+472a6467
npm
AlmaLinux:8
From an advisory covering 3 CVEs
 before 1:10.8.2-1.20.19.2.1.module_el8.10.0+4007+01f7d99b
1:10.8.2-1.20.19.2.1.module_el8.10.0+4007+01f7d99b
nodejs
Azure Linux:3
 through 20.14.0-13 None known
nodejs18
Azure Linux:2
 through 18.20.3-11 None known
Show 104 moreShow less
Affected packages
PackageAffectedFixed
openjdk-nik-23-17
Alpaquita:23
 23.0.4-r1 up to 23.0.9-r0
23.0.9-r0
openjdk-nik-23-21
Alpaquita:23
 23.1.3-r1 up to 23.1.8-r0
23.1.8-r0
openjdk-nik-24-24
Alpaquita:23
 24.2.0-r0 up to 24.2.2-r0
24.2.2-r0
openjdk-nik-23-17
Alpaquita:25
 23.0.8-r0 up to 23.0.9-r0
23.0.9-r0
openjdk-nik-23-21
Alpaquita:25
 23.1.7-r0 up to 23.1.8-r0
23.1.8-r0
openjdk-nik-24-24
Alpaquita:25
 24.2.1-r0 up to 24.2.2-r0
24.2.2-r0
nodejs
Alpaquita:stream
 20.9.0-r0 up to 22.11.0-r0
22.11.0-r0
openjdk-nik-23-17
Alpaquita:stream
 23.0.4-r1 up to 23.0.9-r0
23.0.9-r0
openjdk-nik-23-21
Alpaquita:stream
 23.1.3-r1 up to 23.1.8-r0
23.1.8-r0
openjdk-nik-24-24
Alpaquita:stream
 24.2.0-r0 up to 24.2.2-r0
24.2.2-r0
openjdk-nik-23-17
BellSoft Hardened Containers:23
 23.0.4-r1 up to 23.0.9-r0
23.0.9-r0
openjdk-nik-23-21
BellSoft Hardened Containers:23
 23.1.3-r1 up to 23.1.8-r0
23.1.8-r0
openjdk-nik-24-24
BellSoft Hardened Containers:23
 24.2.0-r0 up to 24.2.2-r0
24.2.2-r0
openjdk-nik-23-17
BellSoft Hardened Containers:25
 23.0.8-r0 up to 23.0.9-r0
23.0.9-r0
openjdk-nik-23-21
BellSoft Hardened Containers:25
 23.1.7-r0 up to 23.1.8-r0
23.1.8-r0
openjdk-nik-24-24
BellSoft Hardened Containers:25
 24.2.1-r0 up to 24.2.2-r0
24.2.2-r0
nodejs
BellSoft Hardened Containers:stream
 20.9.0-r0 up to 22.11.0-r0
22.11.0-r0
openjdk-nik-23-17
BellSoft Hardened Containers:stream
 23.0.4-r1 up to 23.0.9-r0
23.0.9-r0
openjdk-nik-23-21
BellSoft Hardened Containers:stream
 23.1.3-r1 up to 23.1.8-r0
23.1.8-r0
openjdk-nik-24-24
BellSoft Hardened Containers:stream
 24.2.0-r0 up to 24.2.2-r0
24.2.2-r0
node
Bitnami
 before 20.19.2
20.19.2
node-min
Bitnami
 before 20.19.2
20.19.2
nodejs
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els8
1:16.20.2-8.el9_6.tuxcare.els8
nodejs-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els8
1:16.20.2-8.el9_6.tuxcare.els8
nodejs-docs
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els8
1:16.20.2-8.el9_6.tuxcare.els8
nodejs-full-i18n
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els8
1:16.20.2-8.el9_6.tuxcare.els8
nodejs-libs
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 1:16.20.2-8.el9_6.tuxcare.els8
1:16.20.2-8.el9_6.tuxcare.els8
npm
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els8
1:8.19.4_1.16.20.2-8.el9_6.tuxcare.els8
v8-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els8
2:9.4.146.26_1.16.20.2-8.el9_6.tuxcare.els8
node-undici
Debian:12
 All versions, plus listed versions
5.15.0+dfsg1+~cs20.10.9.3-15.15.0+dfsg1+~cs20.10.9.3-1+deb12u15.15.0+dfsg1+~cs20.10.9.3-1+deb12u25.15.0+dfsg1+~cs20.10.9.3-1+deb12u35.15.0+dfsg1+~cs20.10.9.3-1+deb12u4
Show 34 moreShow less
5.19.1+dfsg1+~cs20.10.9.5-15.19.1+dfsg1+~cs20.10.9.5-25.22.1+dfsg1+~cs20.10.10.2-15.26.3+dfsg1+~cs23.10.12-15.26.3+dfsg1+~cs23.10.12-25.26.3+dfsg1+~cs23.10.12-35.28.0+dfsg1+~cs23.11.12.3-15.28.0+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-15.28.2+dfsg1+~cs23.11.12.3-25.28.2+dfsg1+~cs23.11.12.3-35.28.2+dfsg1+~cs23.11.12.3-45.28.2+dfsg1+~cs23.11.12.3-55.28.2+dfsg1+~cs23.11.12.3-65.28.4+dfsg1+~cs23.12.11-15.28.4+dfsg1+~cs23.12.11-27.1.0+dfsg1+~cs24.12.10-17.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-17.2.3+dfsg1+~cs24.12.11-17.2.3+dfsg1+~cs24.12.11-27.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:13
 All versions, plus listed versions
7.15.0+dfsg+~cs3.2.0-17.15.0+dfsg+~cs3.2.0-37.16.0+dfsg+~cs3.2.0-17.16.0+dfsg+~cs3.2.0-27.18.2+dfsg+~cs3.2.0-1
Show 10 moreShow less
7.24.5+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-17.24.6+dfsg+~cs3.2.0-27.24.6+dfsg+~cs3.2.0-37.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-28.5.0+dfsg+~cs3.2.0-18.5.0+dfsg+~cs3.2.0-28.5.0+dfsg+~cs3.2.0-38.9.0+dfsg+~cs3.2.0-1
 None known
node-undici
Debian:14
 before 7.15.0+dfsg+~cs3.2.0-1, plus listed versions
7.3.0+dfsg1+~cs24.12.11-17.3.0+dfsg1+~cs24.12.11-2
7.15.0+dfsg+~cs3.2.0-1
nodejs
Mageia:9
From an advisory covering 3 CVEs
 before 22.16.0-1.mga9
22.16.0-1.mga9
nodejs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el9.6.0+23146+be9976bd
1:20.19.2-1.module+el9.6.0+23146+be9976bd
nodejs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el9.6.0+23146+be9976bd
1:20.19.2-1.module+el9.6.0+23146+be9976bd
nodejs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el9.6.0+23146+be9976bd
1:20.19.2-1.module+el9.6.0+23146+be9976bd
nodejs-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el9.6.0+23146+be9976bd
1:20.19.2-1.module+el9.6.0+23146+be9976bd
nodejs-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el9.6.0+23146+be9976bd
1:20.19.2-1.module+el9.6.0+23146+be9976bd
nodejs-full-i18n
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el9.6.0+23146+be9976bd
1:20.19.2-1.module+el9.6.0+23146+be9976bd
nodejs-nodemon
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el9.6.0+23146+be9976bd
0:3.0.1-1.module+el9.6.0+23146+be9976bd
nodejs-packaging
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el9.6.0+23146+be9976bd
0:2021.06-4.module+el9.6.0+23146+be9976bd
nodejs-packaging-bundler
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el9.6.0+23146+be9976bd
0:2021.06-4.module+el9.6.0+23146+be9976bd
npm
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
 before 1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd
1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd
nodejs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el8.10.0+23139+21ba74c5
1:20.19.2-1.module+el8.10.0+23139+21ba74c5
nodejs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el8.10.0+23139+21ba74c5
1:20.19.2-1.module+el8.10.0+23139+21ba74c5
nodejs-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el8.10.0+23139+21ba74c5
1:20.19.2-1.module+el8.10.0+23139+21ba74c5
nodejs-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el8.10.0+23139+21ba74c5
1:20.19.2-1.module+el8.10.0+23139+21ba74c5
nodejs-docs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el8.10.0+23139+21ba74c5
1:20.19.2-1.module+el8.10.0+23139+21ba74c5
nodejs-full-i18n
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el8.10.0+23139+21ba74c5
1:20.19.2-1.module+el8.10.0+23139+21ba74c5
nodejs-nodemon
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el8.10.0+23139+21ba74c5
0:3.0.1-1.module+el8.10.0+23139+21ba74c5
nodejs-packaging
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el8.10.0+23139+21ba74c5
0:2021.06-4.module+el8.10.0+23139+21ba74c5
nodejs-packaging-bundler
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el8.10.0+23139+21ba74c5
0:2021.06-4.module+el8.10.0+23139+21ba74c5
npm
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5
1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5
nodejs-nodemon
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el9.5.0+31770+0da7192d
0:3.0.1-1.module+el9.5.0+31770+0da7192d
nodejs-nodemon
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01
0:3.0.1-1.module+el9.6.0+32322+a8b1fd01
nodejs-nodemon
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el9.6.0+32045+2e5d342d
0:3.0.1-1.module+el9.6.0+32045+2e5d342d
nodejs-nodemon
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el9.6.0+32143+ae966e5b
0:3.0.1-1.module+el9.6.0+32143+ae966e5b
nodejs-nodemon
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el9.6.0+32144+1d29a396
0:3.0.1-1.module+el9.6.0+32144+1d29a396
nodejs-nodemon
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el9.6.0+32185+bd121a25
0:3.0.1-1.module+el9.6.0+32185+bd121a25
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el9.5.0+31770+0da7192d
0:2021.06-4.module+el9.5.0+31770+0da7192d
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el9.6.0+32045+2e5d342d
0:2021.06-4.module+el9.6.0+32045+2e5d342d
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el9.6.0+32048+5323bb50
0:2021.06-4.module+el9.6.0+32048+5323bb50
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el9.6.0+32143+ae966e5b
0:2021.06-4.module+el9.6.0+32143+ae966e5b
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el9.6.0+32144+1d29a396
0:2021.06-4.module+el9.6.0+32144+1d29a396
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el9.6.0+32185+bd121a25
0:2021.06-4.module+el9.6.0+32185+bd121a25
nodejs-packaging
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el9.6.0+32322+a8b1fd01
0:2021.06-4.module+el9.6.0+32322+a8b1fd01
nodejs
Rocky Linux:9
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el9.6.0+32143+ae966e5b
1:20.19.2-1.module+el9.6.0+32143+ae966e5b
nodejs
Rocky Linux:8
From an advisory covering 3 CVEs
 before 1:20.19.2-1.module+el8.10.0+1988+437f3d23
1:20.19.2-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el8.10.0+1988+437f3d23
0:3.0.1-1.module+el8.10.0+1988+437f3d23
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el8.10.0+1989+e60144d9
0:3.0.1-1.module+el8.10.0+1989+e60144d9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el8.9.0+1760+903d54b9
0:3.0.1-1.module+el8.9.0+1760+903d54b9
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el8.10.0+1666+930e28e8
0:3.0.1-1.module+el8.10.0+1666+930e28e8
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el8.10.0+1667+4a788d89
0:3.0.1-1.module+el8.10.0+1667+4a788d89
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el8.10.0+1823+b5789597
0:3.0.1-1.module+el8.10.0+1823+b5789597
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el8.10.0+1824+532140ee
0:3.0.1-1.module+el8.10.0+1824+532140ee
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el8.10.0+1924+614dc87f
0:3.0.1-1.module+el8.10.0+1924+614dc87f
nodejs-nodemon
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
0:3.0.1-1.module+el8.10.0+1935+d3cbe60f
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el8.10.0+1667+4a788d89
0:2021.06-4.module+el8.10.0+1667+4a788d89
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el8.10.0+1823+b5789597
0:2021.06-4.module+el8.10.0+1823+b5789597
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el8.10.0+1824+532140ee
0:2021.06-4.module+el8.10.0+1824+532140ee
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el8.10.0+1924+614dc87f
0:2021.06-4.module+el8.10.0+1924+614dc87f
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el8.10.0+1988+437f3d23
0:2021.06-4.module+el8.10.0+1988+437f3d23
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el8.10.0+1989+e60144d9
0:2021.06-4.module+el8.10.0+1989+e60144d9
nodejs-packaging
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:2021.06-4.module+el8.9.0+1419+1f26ef47
0:2021.06-4.module+el8.9.0+1419+1f26ef47
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 3 CVEs
 before 20.19.2-150500.11.21.1
20.19.2-150500.11.21.1
nodejs20
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 20.19.2-150500.11.21.1
20.19.2-150500.11.21.1
nodejs20
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 20.19.2-150500.11.21.1
20.19.2-150500.11.21.1
nodejs20
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 3 CVEs
 before 20.19.2-150500.11.21.1
20.19.2-150500.11.21.1
nodejs20
SUSE:Linux Enterprise Module for Web and Scripting 15 SP6
From an advisory covering 3 CVEs
 before 20.19.2-150600.3.12.1
20.19.2-150600.3.12.1
nodejs20
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 20.19.2-150600.3.12.1
20.19.2-150600.3.12.1
nodejs18
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-8.44.1
18.20.8-8.44.1
nodejs18
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 38 CVEs
 before 18.20.8-8.44.1
18.20.8-8.44.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs18
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 38 CVEs
 before 18.20.8-150400.9.39.1
18.20.8-150400.9.39.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 31 CVEs
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1
nodejs16
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 31 CVEs
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1
nodejs16
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 31 CVEs
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1
nodejs16
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 31 CVEs
 before 16.20.2-150400.3.42.1
16.20.2-150400.3.42.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubabhisek3122/CVE-2025-231672025-07-15

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-23167 is a medium vulnerability (CVSS 6.5) in Nodejs Node, published May 19, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in openjdk-nik-23-17 23.0.9-r0.

References

Show 113 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open