Vulnerability in Nodejs Node
CVE-2025-23083
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
EPSS: 0.004 (33.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Nodejs Node — versions 4.0, 5.0, 6.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-23083?
- CVE-2025-23083 is a high-severity vulnerability in Nodejs Node, classified under Improper Access Control. CVSS score: 7.7/10. Published 2025-01-22.
- How severe is CVE-2025-23083?
- High severity. CVSS v3 base score is 7.7 out of 10.
- Is CVE-2025-23083 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.