Homepage

CVE-2025-47153 Affecting nodejs package, versions <12.22.12~dfsg-1~deb11u7

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.08% (26th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN11-NODEJS-9919517
  • published2 May 2025
  • disclosed1 May 2025
Report a new vulnerability Found a mistake?

Introduced: 1 May 2025

NewCVE-2025-47153  (opens in a new tab)

How to fix?

Upgrade Debian:11 nodejs to version 12.22.12dfsg-1deb11u7 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs package and not the nodejs package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.