Search for vulnerabilities
Vulnerability details: VCID-283z-6m4w-xkaz
Vulnerability ID VCID-283z-6m4w-xkaz
Aliases CVE-2025-23083
Summary With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
Status Published
Exploitability 0.5
Weighted Severity 6.9
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-863 Incorrect Authorization
System Score Found at
cvssv3 7.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-23083.json
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
epss 8e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-23083
cvssv3.1 7.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 7.7 https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
ssvc Track https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-23083.json
https://api.first.org/data/v1/epss?cve=CVE-2025-23083
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://security.netapp.com/advisory/ntap-20250228-0008/
https://www.vicarius.io/vsociety/posts/cve-2025-23083-detect-nodejs-vulnerability
https://www.vicarius.io/vsociety/posts/cve-2025-23083-mitigate-nodejs-vulnerability
1094134 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1094134
2339392 https://bugzilla.redhat.com/show_bug.cgi?id=2339392
CVE-2025-23083 https://nvd.nist.gov/vuln/detail/CVE-2025-23083
january-2025-security-releases https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
RHSA-2025:1351 https://access.redhat.com/errata/RHSA-2025:1351
RHSA-2025:1443 https://access.redhat.com/errata/RHSA-2025:1443
RHSA-2025:1522 https://access.redhat.com/errata/RHSA-2025:1522
RHSA-2025:1611 https://access.redhat.com/errata/RHSA-2025:1611
RHSA-2025:1613 https://access.redhat.com/errata/RHSA-2025:1613
No exploits are available.
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-23083.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-28T04:55:27Z/ Found at https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
Exploit Prediction Scoring System (EPSS)
Percentile 0.0052
EPSS Score 8e-05
Published At Aug. 5, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:33:03.526062+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/edge/community.json 37.0.0