Description
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.
Scores
CVSS v3
7.5
EPSS
0.0030
EPSS Percentile
53.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-248
Status
published
Products (21)
nodejs/node
10.0 - 10.*
nodejs/node
11.0 - 11.*
nodejs/node
12.0 - 12.*
nodejs/node
13.0 - 13.*
nodejs/node
14.0 - 14.*
nodejs/node
15.0 - 15.*
nodejs/node
16.0 - 16.*
nodejs/node
17.0 - 17.*
nodejs/node
18.0 - 18.*
nodejs/node
19.0 - 19.*
... and 11 more
Published
May 19, 2025
Tracked Since
Feb 18, 2026