CVE-2025-23166

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

• CWE-248

• https://nodejs.org/en/blog/vulnerability/may-2025-security-releases

Published

May 19, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-23160In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-23161In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-23162In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-23163In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-23164A misconfigured access token mechanism in the Unifi Protect …4.4
• CVE-2025-23165In Node.js, the `ReadFileUtf8` internal binding leaks memory…3.7
• CVE-2025-23167A flaw in Node.js 20's HTTP parser allows improper terminati…6.5
• CVE-2025-23168The Versa Director SD-WAN orchestration platform implements …8.8
• CVE-2025-23169The Versa Director SD-WAN orchestration platform allows cust…6.1
• CVE-2025-2317The Product Filter by WBW plugin for WordPress is vulnerable…7.5
• CVE-2025-23170The Versa Director SD-WAN orchestration platform includes fu…6.7
• CVE-2025-23171The Versa Director SD-WAN orchestration platform provides an…7.2