Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ydzj-e97m-k3cp
Vulnerability ID VCID-ydzj-e97m-k3cp
Aliases CVE-2025-23083
Summary Multiple vulnerabilities have been discovered in Node.js, the worst of which can lead to arbitrary code execution.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-863 Incorrect Authorization
System Score Found at
cvssv3 7.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-23083.json
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 0.00105 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
cvssv3.1 7.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 7.7 https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
ssvc Track https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-23083.json
https://api.first.org/data/v1/epss?cve=CVE-2025-23083
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1094134 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1094134
2339392 https://bugzilla.redhat.com/show_bug.cgi?id=2339392
GLSA-202506-08 https://security.gentoo.org/glsa/202506-08
january-2025-security-releases https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
RHSA-2025:1351 https://access.redhat.com/errata/RHSA-2025:1351
RHSA-2025:1443 https://access.redhat.com/errata/RHSA-2025:1443
RHSA-2025:1522 https://access.redhat.com/errata/RHSA-2025:1522
RHSA-2025:1611 https://access.redhat.com/errata/RHSA-2025:1611
RHSA-2025:1613 https://access.redhat.com/errata/RHSA-2025:1613
No exploits are available.
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-23083.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-28T04:55:27Z/ Found at https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
Exploit Prediction Scoring System (EPSS)
Percentile 0.28663
EPSS Score 0.00105
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:58:35.915450+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202506-08 38.0.0