{"id":"CVE-2025-23165","aliases":["ALPINE-CVE-2025-23165","ALSA-2025:8514","AZL-61913","BELL-CVE-2025-23165","BIT-node-2025-23165","BIT-node-min-2025-23165","DEBIAN-CVE-2025-23165","EUVD-2025-15708","GHSA-gcf6-vgcr-474f","MGASA-2025-0161","OESA-2025-1533","OESA-2025-1534","RHSA-2025:8467","RHSA-2025:8468","RHSA-2025:8493","RHSA-2025:8506","RHSA-2025:8514","RLSA-2025:8467","RLSA-2025:8468","RLSA-2025:8493","RLSA-2025:8506","RLSA-2025:8514","ROOT-OS-DEBIAN-12-CVE-2025-23165","SUSE-SU-2025:01878-1","SUSE-SU-2025:01879-1","SUSE-SU-2025:02039-1","SUSE-SU-2025:02045-1","UBUNTU-CVE-2025-23165","openSUSE-SU-2025:15250-1","openSUSE-SU-2025:15802-1","openSUSE-SU-2026:11110-1"],"status":"published","title":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in ...","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r\n\r\nImpact:\r\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","severity":{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00557,"percentile":0.4689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2025-05-16T06:00:00.234652Z","modified":"2026-11-06T10:58:08Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["22.15.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-9"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nodejs","fixed_in":["22.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","fixed_in":["22.16.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-23-17","fixed_in":["23.0.9-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-23-21","fixed_in":["23.1.8-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-24-24","fixed_in":["24.2.2-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["20.19.2","22.15.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["20.19.2","22.15.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nodejs","fixed_in":["20.19.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nodejs","fixed_in":["20.19.2+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.15.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el8.10.0+4007+01f7d99b"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el8.10.0+4007+01f7d99b"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el8.10.0+4007+01f7d99b"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module_el8.10.0+4007+01f7d99b"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-1.module_el8.10.0+3982+85c136aa"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3987+dbda4426"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.06-4.module_el8.10.0+3958+472a6467"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.2.1.module_el8.10.0+4007+01f7d99b"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-9"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.4-r1"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.3-r1"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.0-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.8-r0"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.7-r0"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.1-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.9.0-r0"},{"fixed":"22.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.4-r1"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.3-r1"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.0-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.4-r1"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.3-r1"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.0-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.8-r0"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.7-r0"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.1-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.9.0-r0"},{"fixed":"22.16.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-23-17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.4-r1"},{"fixed":"23.0.9-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-23-21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.1.3-r1"},{"fixed":"23.1.8-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openjdk-nik-24-24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.2.0-r0"},{"fixed":"24.2.2-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.19.2"},{"introduced":"21.0.0"},{"fixed":"22.15.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"20.19.2"},{"introduced":"21.0.0"},{"fixed":"22.15.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.16.0-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-3.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.18.2-3.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23062+9e7801b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.16.0.1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.16.0.1.module+el9.6.0+23151+b1496e9d"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.2.1.module+el9.6.0+23146+be9976bd"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.16.0.1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"nodejs22-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.9.2-1.22.16.0.1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"v8-12.4-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:12.4.254.21-1.22.16.0.1.module+el8.10.0+23140+4056b950"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.8.2-1.20.19.2.1.module+el8.10.0+23139+21ba74c5"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32045+2e5d342d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32185+bd121a25"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.5.0+31770+0da7192d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32045+2e5d342d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32048+5323bb50"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32144+1d29a396"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32185+bd121a25"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el9.6.0+32322+a8b1fd01"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el9.6.0+32143+ae966e5b"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.el10_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.16.0-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1667+4a788d89"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1823+b5789597"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1924+614dc87f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1935+d3cbe60f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1823+b5789597"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1824+532140ee"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1924+614dc87f"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1988+437f3d23"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1989+e60144d9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+1419+1f26ef47"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.19.2-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1988+437f3d23"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1989+e60144d9"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.9.0+1760+903d54b9"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1666+930e28e8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1667+4a788d89"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1823+b5789597"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1824+532140ee"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1924+614dc87f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-1.module+el8.10.0+1935+d3cbe60f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1667+4a788d89"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1823+b5789597"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1824+532140ee"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1924+614dc87f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1988+437f3d23"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.10.0+1989+e60144d9"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2021.06-4.module+el8.9.0+1419+1f26ef47"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.15.1-150600.13.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.15.1-150600.13.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.15.1-150700.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150500.11.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150500.11.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150500.11.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150500.11.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150600.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.19.2-150600.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.15.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.11.1-2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.3.1-1.1"}]}],"bundled":37}],"products":[{"vendor":"nodejs","product":"node"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/may-2025-security-releases","tags":["web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23165","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-gcf6-vgcr-474f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-23165","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8514","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23166","tags":["report"]},{"url":"https://bugzilla.redhat.com/2367163","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-8514.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-23165.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-23167.html","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-23165","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-23165","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0161.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34278","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23166","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1534","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8467","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2367163","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8467.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2367162","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23165","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23166","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8468","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8468.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-23167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2367167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23167","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8493","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8493.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8506","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-91596","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8506.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-89598","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-91595","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8514.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8467","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8468","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8493","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8506","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8514","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501878-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239949","tags":["report"]},{"url":"https://bugzilla.suse.com/1241050","tags":["report"]},{"url":"https://bugzilla.suse.com/1243217","tags":["report"]},{"url":"https://bugzilla.suse.com/1243218","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23166","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501879-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502039-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243220","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23167","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502045-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-23165","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/may-2025-security-releases#corrupted-pointer-in-nodefsreadfileutf8const-functioncallbackinfovalue-args-when-args0-is-a-string-cve-2025-23165---low","tags":["report"]},{"url":"https://github.com/nodejs/node/commit/9e13bf0a81e15c7b3a9f1826dccbcea991d7e63a","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48936","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-23165","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r\n\r\nImpact:\r\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","status":"published","published":"2025-05-19T01:25:08.569Z","modified":"2025-05-28T00:06:31.253Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:32:33.082076Z"}],"euvd":[{"id":"EUVD-2025-15708","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r\n\r\nImpact:\r\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","status":"published","published":"2025-05-19T01:25:08Z","modified":"2025-05-28T00:06:31Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T20:32:37.949923Z"}],"ghsa":[{"id":"GHSA-gcf6-vgcr-474f","title":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in ...","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\n\nImpact:\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","status":"published","published":"2025-05-19T03:30:29Z","modified":"2025-05-19T15:30:54Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:02:20.924524Z"}],"nvd":[{"id":"CVE-2025-23165","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r\n\r\nImpact:\r\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","status":"published","published":"2025-05-19T02:15:17.37Z","modified":"2026-06-17T08:52:17.997Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:11:09.125937Z"}],"osv":[{"id":"ALPINE-CVE-2025-23165","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r\n\r\nImpact:\r\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","status":"published","published":"2025-05-19T02:15:17.37Z","modified":"2026-08-27T22:18:02.814697958Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2025-23165","status":"published","published":"2025-05-16T06:00:00.234652Z","modified":"2026-02-13T07:19:41.732985Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:28:21.491466Z"},{"id":"DEBIAN-CVE-2025-23165","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r \r Impact:\r * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","status":"published","published":"2025-05-19T02:15:17.37Z","modified":"2026-09-01T20:05:44.437797951Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:45.524682Z"},{"id":"OESA-2025-1533","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nIn Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\n\nImpact:\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.(CVE-2025-23165)\n\nThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.(CVE-2025-23166)","status":"published","published":"2025-05-23T11:08:37Z","modified":"2026-08-18T01:17:58.974736289Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1534","title":"nodejs security update","description":"Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nIn Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\n\nImpact:\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.(CVE-2025-23165)\n\nThe C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.(CVE-2025-23166)","status":"published","published":"2025-05-23T11:08:37Z","modified":"2026-08-18T01:17:58.888792867Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2025:8467","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2025-06-04T10:03:34Z","modified":"2026-08-07T10:20:42Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8468","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2025-06-04T10:03:34Z","modified":"2026-08-07T10:20:42Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8493","title":"Red Hat Security Advisory: nodejs22 security update","status":"published","published":"2025-06-04T10:03:39Z","modified":"2026-08-07T10:20:45Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8506","title":"Red Hat Security Advisory: nodejs:22 security update","status":"published","published":"2025-06-05T10:04:30Z","modified":"2026-08-07T10:20:45Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8514","title":"Red Hat Security Advisory: nodejs:20 security update","status":"published","published":"2025-06-05T10:04:31Z","modified":"2026-08-07T10:20:47Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RLSA-2025:8467","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:40:19.644888Z","modified":"2025-10-07T17:39:44.777193Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8468","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:40:19.644888Z","modified":"2025-10-07T17:39:44.363123Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8493","title":"Important: nodejs22 security update","description":"Node.js is a platform built on Chrome's JavaScript runtime \\ for easily building fast, scalable network applications. \\ Node.js uses an event-driven, non-blocking I/O model that \\ makes it lightweight and efficient, perfect for data-intensive \\ real-time applications that run across distributed devices.\n\nSecurity Fix(es):\n\n* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-03T20:18:54.771582Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8506","title":"Important: nodejs:22 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:11.720979Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8514","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:12.131975Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-23165","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Impact: * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","status":"withdrawn","published":"2025-05-19T02:15:00Z","modified":"2026-01-20T19:18:33.082342Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"ALSA-2025:8514","title":"Important: nodejs:20 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.   \n\nSecurity Fix(es):  \n\n  * nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-04T00:00:00Z","modified":"2026-11-06T10:58:08.58351657Z","updated_at":"2026-11-06T11:08:40.431174Z"},{"id":"AZL-61913","title":"CVE-2025-23165 affecting package nodejs for versions less than 20.14.0-9","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r\n\r\nImpact:\r\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","status":"published","published":"2025-05-19T02:15:17Z","modified":"2026-06-02T05:26:23Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BIT-node-2025-23165","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r\n\r\nImpact:\r\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","status":"published","published":"2025-05-21T06:00:20.189Z","modified":"2025-05-21T06:28:28.597306Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2025-23165","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r\n\r\nImpact:\r\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","status":"published","published":"2025-05-21T06:00:19.398Z","modified":"2025-05-21T06:28:28.597306Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CVE-2025-23165","description":"In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.\r\n\r\nImpact:\r\n* This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.","status":"published","published":"2025-05-19T02:15:17Z","modified":"2026-11-06T10:57:01.383480197Z","updated_at":"2026-11-06T11:08:47.346964Z"},{"id":"MGASA-2025-0161","title":"Updated nodejs packages fix security vulnerabilities","description":"Corrupted pointer in node::fs::ReadFileUtf8(const\nFunctionCallbackInfo\u003cValue\u003e\u0026 args) when args[0] is a string.\n(CVE-2025-23165)\nImproper error handling in async cryptographic operations crashes\nprocess. (CVE-2025-23166)\nImproper HTTP header block termination in llhttp. (CVE-2025-23167)\n","status":"published","published":"2025-05-24T23:25:56Z","modified":"2026-04-16T04:41:20.367854037Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15250-1","title":"corepack22-22.15.1-1.1 on GA media","description":"These are all security issues fixed in the corepack22-22.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:32.851799Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15802-1","title":"corepack24-24.11.1-2.1 on GA media","description":"These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-08T00:00:00Z","modified":"2026-03-23T04:54:11.929189Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11110-1","title":"nodejs26-26.3.1-1.1 on GA media","description":"These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:19.692832432Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2025-23165","title":"CVE-2025-23165 in rootio-nodejs - Patched by Root","description":"Root has patched CVE-2025-23165 in the rootio-nodejs package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2025-08-12T08:24:43Z","modified":"2026-08-27T14:00:06.305695666Z","updated_at":"2026-11-02T15:53:30.983521Z"},{"id":"SUSE-SU-2025:01878-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\nUpdate to version 22.15.1.\n\nSecurity issues fixed:\n\n- CVE-2025-23166: remotely triggerable process crash due to improper error handling in async cryptographic operations\n  (bsc#1243218).\n- CVE-2025-23165: memory leak and unbounded memory growth due to corrupted pointer in\n  `node::fs::ReadFileUtf8(const FunctionCallbackInfo\u003cValue\u003e\u0026 args)` when `args[0]` is a string (bsc#1243217).\n  \nOther changes and issues fixed:\n\n- Changes from version 22.15.0\n\n  * dns: add TLSA record query and parsing\n  * assert: improve partialDeepStrictEqual\n  * process: add execve\n  * tls: implement tls.getCACertificates()\n  * v8: add v8.getCppHeapStatistics() method\n\n- Changes from version 22.14.0\n \n  * fs: allow exclude option in globs to accept glob patterns\n  * lib: add typescript support to STDIN eval\n  * module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX\n  * module: add findPackageJSON util\n  * process: add process.ref() and process.unref() methods\n  * sqlite: support TypedArray and DataView in StatementSync\n  * src: add --disable-sigusr1 to prevent signal i/o thread\n  * src,worker: add isInternalWorker\n  * test_runner: add TestContext.prototype.waitFor()\n  * test_runner: add t.assert.fileSnapshot()\n  * test_runner: add assert.register() API\n  * worker: add eval ts input\n  \n- Build with PIE (bsc#1239949).\n- Fix builds with OpenSSL 3.5.0 (bsc#1241050).\n","status":"published","published":"2025-06-11T05:41:14Z","modified":"2026-02-04T03:37:32.090442Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:01879-1","title":"Security update for nodejs22","description":"This update for nodejs22 fixes the following issues:\n\nUpdate to version 22.15.1.\n\nSecurity issues fixed:\n\n- CVE-2025-23166: remotely triggerable process crash due to improper error handling in async cryptographic operations\n  (bsc#1243218).\n- CVE-2025-23165: memory leak and unbounded memory growth due to corrupted pointer in\n  `node::fs::ReadFileUtf8(const FunctionCallbackInfo\u003cValue\u003e\u0026 args)` when `args[0]` is a string (bsc#1243217).\n  \nOther changes and issues fixed:\n\n- Changes from version 22.15.0\n\n  * dns: add TLSA record query and parsing\n  * assert: improve partialDeepStrictEqual\n  * process: add execve\n  * tls: implement tls.getCACertificates()\n  * v8: add v8.getCppHeapStatistics() method\n\n- Changes from version 22.14.0\n \n  * fs: allow exclude option in globs to accept glob patterns\n  * lib: add typescript support to STDIN eval\n  * module: add ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX\n  * module: add findPackageJSON util\n  * process: add process.ref() and process.unref() methods\n  * sqlite: support TypedArray and DataView in StatementSync\n  * src: add --disable-sigusr1 to prevent signal i/o thread\n  * src,worker: add isInternalWorker\n  * test_runner: add TestContext.prototype.waitFor()\n  * test_runner: add t.assert.fileSnapshot()\n  * test_runner: add assert.register() API\n  * worker: add eval ts input\n  \n- Build with PIE (bsc#1239949).\n- Fix builds with OpenSSL 3.5.0 (bsc#1241050).\n","status":"published","published":"2025-06-11T05:41:29Z","modified":"2026-02-04T02:53:17.225122Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:02039-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.19.2:\n\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).\n\nOther bugfixes:\n\n- Build with PIE (bsc#1239949)\n","status":"published","published":"2025-06-20T09:40:53Z","modified":"2026-03-23T04:46:25.776131Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02045-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.19.2:\n\n- CVE-2025-23166: improper error handling in async cryptographic operations crashes process (bsc#1243218).\n- CVE-2025-23167: improper HTTP header block termination in llhttp (bsc#1243220).\n- CVE-2025-23165: add missing call to uv_fs_req_cleanup (bsc#1243217).\n\nOther bugfixes:\n\n- Build with PIE (bsc#1239949)\n","status":"published","published":"2025-06-20T11:04:00Z","modified":"2026-03-23T04:49:34.072515Z","updated_at":"2026-11-02T15:53:56.647031Z"}]}}