CVE-2025-23166 Affecting nodejs-docs package, versions <1:22.16.0-1.module+el9.6.0+90604+9071ea19


Severity

Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.06% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE9-NODEJSDOCS-10302974
  • published5 Jun 2025
  • disclosed19 May 2025

Introduced: 19 May 2025

NewCVE-2025-23166  (opens in a new tab)

How to fix?

Upgrade Oracle:9 nodejs-docs to version 1:22.16.0-1.module+el9.6.0+90604+9071ea19 or higher.
This issue was patched in ELSA-2025-8467.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs-docs package and not the nodejs-docs package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.