CVE-2025-23083
Publication date 22 January 2025
Last updated 11 July 2025
Ubuntu priority
Cvss 3 Severity Score
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
Status
Package | Ubuntu Release | Status |
---|---|---|
nodejs | 25.04 plucky |
Vulnerable
|
24.04 LTS noble |
Not affected
|
|
22.04 LTS jammy |
Not affected
|
|
20.04 LTS focal |
Not affected
|
|
18.04 LTS bionic |
Not affected
|
|
16.04 LTS xenial |
Not affected
|
|
14.04 LTS trusty |
Not affected
|
Severity score breakdown
Parameter | Value |
---|---|
Base score |
|
Attack vector | Local |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | None |
Vector | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2025-23083
- https://nodejs.org/en/blog/vulnerability/january-2025-security-releases#worker-permission-bypass-via-internalworker-leak-in-diagnostics-cve-2025-23083---high
- https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
- https://github.com/nodejs/node/commit/51938f023aac90dc1dc0bc1f743501788613210e