High severity · published Jan 22, 2025
CVE-2025-23083
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created
7.7
CVSS
0.4%
EPSS
No
On KEV
Description
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage.
This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Node · NodeJS
4.0 before 4.*; 5.0 before 5.*; 6.0 before 6.*; 7.0 before 7.*; 8.0 before 8.*; 9.0 before 9.*; +13 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-23083
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-23083
nodejs.org
https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
security.netapp.com
https://security.netapp.com/advisory/ntap-20250228-0008/
www.vicarius.io
https://www.vicarius.io/vsociety/posts/cve-2025-23083-detect-nodejs-vulnerability
www.vicarius.io
https://www.vicarius.io/vsociety/posts/cve-2025-23083-mitigate-nodejs-vulnerability
More from Node
10.0
CVE-2026-21636
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled
9.8
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
9.1
CVE-2025-55130
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths
8.4
CVE-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries
8.2
CVE-2026-48617
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation