{"id":"CVE-2025-27209","aliases":["BELL-CVE-2025-27209","BIT-node-2025-27209","BIT-node-min-2025-27209","EUVD-2025-21940","GHSA-qr33-gf7m-pq45"],"status":"published","title":"The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash...","description":"The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.\r\n\r\n* This vulnerability affects Node.js v24.x users.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01253,"percentile":0.69702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2025-07-18T22:54:27Z","modified":"2026-06-17T09:03:12Z","fixes":[{"ecosystem":"Bitnami","package":"node","fixed_in":["24.4.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["24.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"24.0.0"},{"fixed":"24.4.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"24.0.0"},{"fixed":"24.4.1"}]}]}],"products":[{"vendor":"nodejs","product":"node"}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/july-2025-security-releases","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/22/2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27209","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qr33-gf7m-pq45"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-27209","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-27209","description":"The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.\r\n\r\n* This vulnerability affects Node.js v24.x users.","status":"published","published":"2025-07-18T22:54:27.205Z","modified":"2025-11-04T21:09:46.228Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-21940","description":"The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.\r\n\r\n* This vulnerability affects Node.js v24.x users.","status":"published","published":"2025-07-18T22:54:27Z","modified":"2025-11-04T21:09:46Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:21.645169Z"}],"ghsa":[{"id":"GHSA-qr33-gf7m-pq45","title":"The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash...","description":"The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.\n\n* This vulnerability affects Node.js v24.x users.","status":"published","published":"2025-07-19T00:32:31Z","modified":"2025-07-21T21:31:35Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:03:04.468862Z"}],"nvd":[{"id":"CVE-2025-27209","description":"The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.\r\n\r\n* This vulnerability affects Node.js v24.x users.","status":"published","published":"2025-07-18T23:15:23.19Z","modified":"2026-06-17T09:03:12.737Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:11:18.782156Z"}],"osv":[{"id":"BELL-CVE-2025-27209","title":"CVE-2025-27209 does not affect BellSoft software","status":"withdrawn","published":"2025-07-22T06:02:20.290866Z","modified":"2026-02-18T07:15:59.699991Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:21.741325Z"},{"id":"BIT-node-2025-27209","description":"The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.\r\n\r\n* This vulnerability affects Node.js v24.x users.","status":"published","published":"2025-07-22T05:47:27.57Z","modified":"2025-11-06T13:25:46.476Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2025-27209","description":"The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.\r\n\r\n* This vulnerability affects Node.js v24.x users.","status":"published","published":"2025-07-22T05:47:29.602Z","modified":"2025-11-06T13:25:46.476Z","updated_at":"2026-11-02T15:28:34.007508Z"}]}}