s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

CVE-2025-23166

📛 CVE Title

CVE-2025-23166

⬇ Download JSON ⚠ View as Threat

Description

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

Overview

State
PUBLISHED
Assigner (CNA)
hackerone
CVSS severity
HIGH
CVSS score
CVSS 7.5 / 10 7.5 7.5 / 10
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Effective score
7.5 / 10 HIGH source: CNA overview
MSRC score
7.5 / 10 HIGH MS rating: Moderate
CWE(s)
CWE-248
Reserved
2025-01-12
Published
2025-05-19 03:25 UTC
Last updated
2025-05-28 02:07 UTC
Source
https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/23xxx/CVE-2025-23166.json
Linked Threat
CVE-2025-23166 — CVE-2025-23166

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published
2025-05-19 02:15:17 UTC
NVD last modified
2026-06-17 08:52:18 UTC
EPSS score
0.0076 (probability of exploitation in next 30 days)
EPSS percentile
50.93% vs all CVEs — higher = more likely to be exploited, as of 2026-07-07

NVD / KEV / EPSS data refreshed 2026-07-07 17:41 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID
EUVD-2025-15702
Assigner
hackerone
Published
May 19, 2025, 1:25:08 AM
Updated
May 28, 2025, 12:07:12 AM
EUVD base score (CVSS 3.0)
7.5 / 10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EUVD-reported EPSS
0.3000
Vendors
nodejs
Products
Node (8.0 <8.*)
Node (16.0 <16.*)
Node (23.0 ≤23.11.0)
Node (15.0 <15.*)
Node (20.0 ≤20.19.1)
Node (11.0 <11.*)
Node (19.0 <19.*)
Node (12.0 <12.*)
Node (17.0 <17.*)
Node (8.0 <8.*)
Node (17.0 <17.*)
Node (22.15.0 ≤22.15.0)
Node (9.0 <9.*)
Node (22.0 ≤22.15.0)
Node (14.0 <14.*)
Node (21.0 <21.*)
Node (18.0 <18.*)
Node (20.0 ≤20.19.1)
Node (18.0 <18.*)
Node (7.0 <7.*)
Node (19.0 <19.*)
Node (15.0 <15.*)
Node (7.0 <7.*)
Node (22.0 ≤22.15.0)
Node (16.0 <16.*)
Node (4.0 <4.*)
Node (23.11.0 ≤23.11.0)
Node (24.0 ≤24.0.1)
Node (12.0 <12.*)
Node (5.0 <5.*)
Node (24.0 ≤24.0.1)
Node (13.0 <13.*)
Node (23.0 ≤23.11.0)
Node (6.0 <6.*)
Node (24.0.1 ≤24.0.1)
Node (11.0 <11.*)
Node (9.0 <9.*)
Node (4.0 <4.*)
Node (21.0 <21.*)
Node (14.0 <14.*)
Node (6.0 <6.*)
Node (5.0 <5.*)
Node (20.19.1 ≤20.19.1)
Node (13.0 <13.*)
Node (10.0 <10.*)
Node (10.0 <10.*)
Aliases
GHSA-rrjv-57mm-j6cm

ENISA description: The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

EUVD references (1)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-08-12 01:11 UTC (source: CVRF).

MS severity
Moderate
MS CVSS base score
7.5 / 10 (temporal 7.5)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release
2025-May
Microsoft remediations / KB articles (5)
Microsoft FAQ (1)

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?

One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.

Affected products (1)
VendorProductVersionsPlatforms
nodejs node 4.0 (affected), 5.0 (affected), 6.0 (affected), 7.0 (affected), 8.0 (affected), 9.0 (affected), 10.0 (affected), 11.0 (affected), 12.0 (affected), 13.0 (affected), 14.0 (affected), 15.0 (affected), 16.0 (affected), 17.0 (affected), 18.0 (affected), 19.0 (affected), 20.0 (affected), 22.0 (affected), 23.0 (affected), 24.0 (affected), 21.0 (affected) —

Vendor references (1)

References embedded in the original CVE record by the assigning CNA.

Web references (24)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

NVD-tagged references (1)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

Indicators (1)

IOCs linked to the auto-promoted Threat row.

TypeValueVirusTotalAttached
domain node.js no local data 2026-05-18 21:19 UTC

Flagged vendors

    Remediations (15)

    Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

    • Critical Patches Issued for Microsoft Products, April 14, 2026
      web:www.cisecurity.org

      <p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...

      2026-05-22 12:21 UTC
    • Zero-Day Threat Report May 2026 - CVEs, Exploits & Remediation ...
      web:carthageelectronics.com

      Status: Actively exploited — CISA KEV listed — patch by May 12, 2026 What Happened On April 28, 2026, CISA added CVE -2026-32202 to its Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of May 12, 2026. This vulnerability is the result of an incomplete patch Microsoft released in February for CVE -2026-21510.

      2026-05-22 12:21 UTC
    • CVE-2025-23166 - Exploits & Severity - Feedly
      web:feedly.com

      May 15, 2025 at 4:05 AM CVE Assignment NVD published the first details for CVE-2025-23166 May 18, 2025 at 7:15 PM Vendor Advisory RedHat CVE advisory released a security advisory ( CVE-2025-23166 ).

      2026-05-22 12:21 UTC
    • CISA Issues Alert on New GitHub Actions Vulnerability
      web:www.quorumcyber.com

      Containment, Mitigations & Remediation It is highly recommended to update to the latest version of tj-actions/changed-files by Friday 4th April 2025 . CISA has also provided guidance on strengthening security when using third-party actions. Please read CISA's Supply Chain Compromise of Third-Party GitHub Action, CVE - 2025 -30066 | CISA alert.

      2026-05-22 12:21 UTC
    • CVE-2025-23166 - Vulnerability Details - OpenCVE
      web:app.opencve.io

      The C++ method SignTraits::DeriveBits () may incorrectly call ThrowException () based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

      2026-05-22 12:21 UTC
    • Security Update Guide - Microsoft
      web:portal.msrc.microsoft.com

      The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

      2026-05-22 03:25 UTC
    • Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws
      web:www.bleepingcomputer.com

      Today is Microsoft's March 2026 Patch Tuesday with security updates for 79 flaws, including 2 publicly disclosed zero-day vulnerabilities.

      2026-05-22 03:25 UTC
    • Supply Chain Compromise of Third-Party tj-actions/changed-files ... - CISA
      web:www.cisa.gov

      Identify affected repositories. Conduct an audit to locate all projects using all versions of tj-actions/changed-files between 2025 -03-12 00:00 UTC to 2025 -03-15 12:00 UTC in your organization and/ or the reviewdog/action between March 11, 2025 , between 18:42 and 20:31 UTC.

      2026-05-22 03:25 UTC
    • CVE Record: CVE-2025-23166
      web:www.cve.org

      Vulnerability detail for CVE-2025-23166 Notice: Expanded keyword searching of CVE Records (with limitations) is now available in the search box above. Learn more here.

      2026-05-22 03:25 UTC
    • Microsoft's March 2026 update fixes 80+ security vulnerabilities
      web:www.pcworld.com

      This month's Patch Tuesday brings over 80 fixes for various security vulnerabilities. Fortunately, none are actively being exploited in the wild yet.

      2026-05-22 03:25 UTC
    • Patch Tuesday May 2026: Security Updates & CVE Analysis
      web:zecurit.com

      Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

      2026-05-22 03:25 UTC
    • Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review
      web:blog.qualys.com

      May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy…

      2026-05-22 03:25 UTC
    • CVE-2025-23166 Security Vulnerability & Exploit Details
      web:cve.akaoma.com

      The exploitability of CVE-2025-23166 depends on two key factors: attack complexity (the level of effort required to execute an exploit) and privileges required (the access level an attacker needs). Exploitability Analysis for CVE-2025-23166 With low attack complexity and no required privileges, CVE-2025-23166 is an easy target for cybercriminals.

      2026-05-22 03:25 UTC
    • Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...
      web:cybersecuritynews.com

      Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

      2026-05-22 03:25 UTC
    • Wednesday, May 14, 2025 Security Releases - Node.js
      web:nodejs.org

      Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

      2026-05-22 03:25 UTC

    AI Forensic Analysis

    Only Available for Registered Users. Sign in to view.

    Raw JSON

    The full cvelistV5 record. Download as CVE-2025-23166.json.

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-23166",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-19T14:11:17.877460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-248",
                "description": "CWE-248 Uncaught Exception",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-19T14:13:24.973Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "node",
          "vendor": "nodejs",
          "versions": [
            {
              "lessThan": "4.*",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.*",
              "status": "affected",
              "version": "5.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.*",
              "status": "affected",
              "version": "6.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.*",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.*",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.*",
              "status": "affected",
              "version": "9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.*",
              "status": "affected",
              "version": "10.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.*",
              "status": "affected",
              "version": "11.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.*",
              "status": "affected",
              "version": "12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.*",
              "status": "affected",
              "version": "13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.*",
              "status": "affected",
              "version": "14.0",
              "versionType": "semver"
            },
            {
              "lessThan": "15.*",
              "status": "affected",
              "version": "15.0",
              "versionType": "semver"
            },
            {
              "lessThan": "16.*",
              "status": "affected",
              "version": "16.0",
              "versionType": "semver"
            },
            {
              "lessThan": "17.*",
              "status": "affected",
              "version": "17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "18.*",
              "status": "affected",
              "version": "18.0",
              "versionType": "semver"
            },
            {
              "lessThan": "19.*",
              "status": "affected",
              "version": "19.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "20.19.1",
              "status": "affected",
              "version": "20.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "22.15.0",
              "status": "affected",
              "version": "22.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "23.11.0",
              "status": "affected",
              "version": "23.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "24.0.1",
              "status": "affected",
              "version": "24.0",
              "versionType": "semver"
            },
            {
              "lessThan": "21.*",
              "status": "affected",
              "version": "21.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-28T00:07:12.640Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://nodejs.org/en/blog/vulnerability/may-2025-security-releases"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2025-23166",
    "datePublished": "2025-05-19T01:25:08.462Z",
    "dateReserved": "2025-01-12T01:00:00.648Z",
    "dateUpdated": "2025-05-28T00:07:12.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}