csaf_suse - suse-su-2025:0284-1

Vulnerability from csaf_suse

Published

2025-01-29 13:47

Modified

2025-01-29 13:47

Summary

Security update for nodejs22

Notes

Title of the patch

Security update for nodejs22

Description of the patch

This update for nodejs22 fixes the following issues: Update to 22.13.1: - CVE-2025-23083: Fixed worker permission bypass via InternalWorker leak in diagnostics (bsc#1236251) - CVE-2025-23085: Fixed HTTP2 memory leak on premature close and ERR_PROTO (bsc#1236250) - CVE-2025-22150: Fixed insufficiently random values used when defining the boundary for a multipart/form-data request in undici (bsc#1236258)

Patchnames

SUSE-2025-284,SUSE-SLE-Module-Web-Scripting-15-SP6-2025-284,openSUSE-SLE-15.6-2025-284

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for nodejs22",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for nodejs22 fixes the following issues:\n\nUpdate to 22.13.1:\n\n- CVE-2025-23083: Fixed worker permission bypass via InternalWorker leak in diagnostics (bsc#1236251)\n- CVE-2025-23085: Fixed HTTP2 memory leak on premature close and ERR_PROTO (bsc#1236250)\n- CVE-2025-22150: Fixed insufficiently random values used when defining the boundary for a multipart/form-data request in undici (bsc#1236258)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2025-284,SUSE-SLE-Module-Web-Scripting-15-SP6-2025-284,openSUSE-SLE-15.6-2025-284",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0284-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2025:0284-1",
            url: "https://www.suse.com/support/update/announcement/2025/suse-su-20250284-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2025:0284-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020235.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1236250",
            url: "https://bugzilla.suse.com/1236250",
         },
         {
            category: "self",
            summary: "SUSE Bug 1236251",
            url: "https://bugzilla.suse.com/1236251",
         },
         {
            category: "self",
            summary: "SUSE Bug 1236258",
            url: "https://bugzilla.suse.com/1236258",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-22150 page",
            url: "https://www.suse.com/security/cve/CVE-2025-22150/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-23083 page",
            url: "https://www.suse.com/security/cve/CVE-2025-23083/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-23085 page",
            url: "https://www.suse.com/security/cve/CVE-2025-23085/",
         },
      ],
      title: "Security update for nodejs22",
      tracking: {
         current_release_date: "2025-01-29T13:47:55Z",
         generator: {
            date: "2025-01-29T13:47:55Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2025:0284-1",
         initial_release_date: "2025-01-29T13:47:55Z",
         revision_history: [
            {
               date: "2025-01-29T13:47:55Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack22-22.13.1-150600.13.6.1.aarch64",
                        product: {
                           name: "corepack22-22.13.1-150600.13.6.1.aarch64",
                           product_id: "corepack22-22.13.1-150600.13.6.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs22-22.13.1-150600.13.6.1.aarch64",
                        product: {
                           name: "nodejs22-22.13.1-150600.13.6.1.aarch64",
                           product_id: "nodejs22-22.13.1-150600.13.6.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                        product: {
                           name: "nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                           product_id: "nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm22-22.13.1-150600.13.6.1.aarch64",
                        product: {
                           name: "npm22-22.13.1-150600.13.6.1.aarch64",
                           product_id: "npm22-22.13.1-150600.13.6.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack22-22.13.1-150600.13.6.1.i586",
                        product: {
                           name: "corepack22-22.13.1-150600.13.6.1.i586",
                           product_id: "corepack22-22.13.1-150600.13.6.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs22-22.13.1-150600.13.6.1.i586",
                        product: {
                           name: "nodejs22-22.13.1-150600.13.6.1.i586",
                           product_id: "nodejs22-22.13.1-150600.13.6.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs22-devel-22.13.1-150600.13.6.1.i586",
                        product: {
                           name: "nodejs22-devel-22.13.1-150600.13.6.1.i586",
                           product_id: "nodejs22-devel-22.13.1-150600.13.6.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm22-22.13.1-150600.13.6.1.i586",
                        product: {
                           name: "npm22-22.13.1-150600.13.6.1.i586",
                           product_id: "npm22-22.13.1-150600.13.6.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                        product: {
                           name: "nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                           product_id: "nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack22-22.13.1-150600.13.6.1.ppc64le",
                        product: {
                           name: "corepack22-22.13.1-150600.13.6.1.ppc64le",
                           product_id: "corepack22-22.13.1-150600.13.6.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs22-22.13.1-150600.13.6.1.ppc64le",
                        product: {
                           name: "nodejs22-22.13.1-150600.13.6.1.ppc64le",
                           product_id: "nodejs22-22.13.1-150600.13.6.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                        product: {
                           name: "nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                           product_id: "nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm22-22.13.1-150600.13.6.1.ppc64le",
                        product: {
                           name: "npm22-22.13.1-150600.13.6.1.ppc64le",
                           product_id: "npm22-22.13.1-150600.13.6.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack22-22.13.1-150600.13.6.1.s390x",
                        product: {
                           name: "corepack22-22.13.1-150600.13.6.1.s390x",
                           product_id: "corepack22-22.13.1-150600.13.6.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs22-22.13.1-150600.13.6.1.s390x",
                        product: {
                           name: "nodejs22-22.13.1-150600.13.6.1.s390x",
                           product_id: "nodejs22-22.13.1-150600.13.6.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                        product: {
                           name: "nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                           product_id: "nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm22-22.13.1-150600.13.6.1.s390x",
                        product: {
                           name: "npm22-22.13.1-150600.13.6.1.s390x",
                           product_id: "npm22-22.13.1-150600.13.6.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack22-22.13.1-150600.13.6.1.x86_64",
                        product: {
                           name: "corepack22-22.13.1-150600.13.6.1.x86_64",
                           product_id: "corepack22-22.13.1-150600.13.6.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs22-22.13.1-150600.13.6.1.x86_64",
                        product: {
                           name: "nodejs22-22.13.1-150600.13.6.1.x86_64",
                           product_id: "nodejs22-22.13.1-150600.13.6.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                        product: {
                           name: "nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                           product_id: "nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm22-22.13.1-150600.13.6.1.x86_64",
                        product: {
                           name: "npm22-22.13.1-150600.13.6.1.x86_64",
                           product_id: "npm22-22.13.1-150600.13.6.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
                        product: {
                           name: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
                           product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-web-scripting:15:sp6",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "openSUSE Leap 15.6",
                        product: {
                           name: "openSUSE Leap 15.6",
                           product_id: "openSUSE Leap 15.6",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:leap:15.6",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-22.13.1-150600.13.6.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.aarch64",
            },
            product_reference: "nodejs22-22.13.1-150600.13.6.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-22.13.1-150600.13.6.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
            },
            product_reference: "nodejs22-22.13.1-150600.13.6.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-22.13.1-150600.13.6.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.s390x",
            },
            product_reference: "nodejs22-22.13.1-150600.13.6.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-22.13.1-150600.13.6.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.x86_64",
            },
            product_reference: "nodejs22-22.13.1-150600.13.6.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-devel-22.13.1-150600.13.6.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
            },
            product_reference: "nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-devel-22.13.1-150600.13.6.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
            },
            product_reference: "nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-devel-22.13.1-150600.13.6.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
            },
            product_reference: "nodejs22-devel-22.13.1-150600.13.6.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-devel-22.13.1-150600.13.6.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
            },
            product_reference: "nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-docs-22.13.1-150600.13.6.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
            },
            product_reference: "nodejs22-docs-22.13.1-150600.13.6.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm22-22.13.1-150600.13.6.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.aarch64",
            },
            product_reference: "npm22-22.13.1-150600.13.6.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm22-22.13.1-150600.13.6.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.ppc64le",
            },
            product_reference: "npm22-22.13.1-150600.13.6.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm22-22.13.1-150600.13.6.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.s390x",
            },
            product_reference: "npm22-22.13.1-150600.13.6.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm22-22.13.1-150600.13.6.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.x86_64",
            },
            product_reference: "npm22-22.13.1-150600.13.6.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "corepack22-22.13.1-150600.13.6.1.aarch64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.aarch64",
            },
            product_reference: "corepack22-22.13.1-150600.13.6.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "corepack22-22.13.1-150600.13.6.1.ppc64le as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.ppc64le",
            },
            product_reference: "corepack22-22.13.1-150600.13.6.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "corepack22-22.13.1-150600.13.6.1.s390x as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.s390x",
            },
            product_reference: "corepack22-22.13.1-150600.13.6.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "corepack22-22.13.1-150600.13.6.1.x86_64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.x86_64",
            },
            product_reference: "corepack22-22.13.1-150600.13.6.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-22.13.1-150600.13.6.1.aarch64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.aarch64",
            },
            product_reference: "nodejs22-22.13.1-150600.13.6.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-22.13.1-150600.13.6.1.ppc64le as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
            },
            product_reference: "nodejs22-22.13.1-150600.13.6.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-22.13.1-150600.13.6.1.s390x as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.s390x",
            },
            product_reference: "nodejs22-22.13.1-150600.13.6.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-22.13.1-150600.13.6.1.x86_64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.x86_64",
            },
            product_reference: "nodejs22-22.13.1-150600.13.6.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-devel-22.13.1-150600.13.6.1.aarch64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
            },
            product_reference: "nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-devel-22.13.1-150600.13.6.1.ppc64le as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
            },
            product_reference: "nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-devel-22.13.1-150600.13.6.1.s390x as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
            },
            product_reference: "nodejs22-devel-22.13.1-150600.13.6.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-devel-22.13.1-150600.13.6.1.x86_64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
            },
            product_reference: "nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs22-docs-22.13.1-150600.13.6.1.noarch as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
            },
            product_reference: "nodejs22-docs-22.13.1-150600.13.6.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm22-22.13.1-150600.13.6.1.aarch64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.aarch64",
            },
            product_reference: "npm22-22.13.1-150600.13.6.1.aarch64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm22-22.13.1-150600.13.6.1.ppc64le as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.ppc64le",
            },
            product_reference: "npm22-22.13.1-150600.13.6.1.ppc64le",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm22-22.13.1-150600.13.6.1.s390x as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.s390x",
            },
            product_reference: "npm22-22.13.1-150600.13.6.1.s390x",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm22-22.13.1-150600.13.6.1.x86_64 as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.x86_64",
            },
            product_reference: "npm22-22.13.1-150600.13.6.1.x86_64",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2025-22150",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-22150",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-22150",
               url: "https://www.suse.com/security/cve/CVE-2025-22150",
            },
            {
               category: "external",
               summary: "SUSE Bug 1236257 for CVE-2025-22150",
               url: "https://bugzilla.suse.com/1236257",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.8,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-29T13:47:55Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-22150",
      },
      {
         cve: "CVE-2025-23083",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-23083",
            },
         ],
         notes: [
            {
               category: "general",
               text: "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \r\n\r\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-23083",
               url: "https://www.suse.com/security/cve/CVE-2025-23083",
            },
            {
               category: "external",
               summary: "SUSE Bug 1236251 for CVE-2025-23083",
               url: "https://bugzilla.suse.com/1236251",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-29T13:47:55Z",
               details: "important",
            },
         ],
         title: "CVE-2025-23083",
      },
      {
         cve: "CVE-2025-23085",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-23085",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.\r\n\r\nThis vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
               "openSUSE Leap 15.6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.aarch64",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.ppc64le",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.s390x",
               "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-23085",
               url: "https://www.suse.com/security/cve/CVE-2025-23085",
            },
            {
               category: "external",
               summary: "SUSE Bug 1236250 for CVE-2025-23085",
               url: "https://bugzilla.suse.com/1236250",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 15 SP6:npm22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:corepack22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:nodejs22-devel-22.13.1-150600.13.6.1.x86_64",
                  "openSUSE Leap 15.6:nodejs22-docs-22.13.1-150600.13.6.1.noarch",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.aarch64",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.ppc64le",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.s390x",
                  "openSUSE Leap 15.6:npm22-22.13.1-150600.13.6.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-29T13:47:55Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-23085",
      },
   ],
}

cve-2025-23085

Vulnerability from cvelistv5

Published

2025-02-07 07:09

Modified

2025-02-25 13:07

Severity ?

5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

References

▼	URL	Tags
	https://nodejs.org/en/blog/vulnerability/january-2025-security-releases

Impacted products

	Vendor	Product	Version
	nodejs	node	Version: 18.20.5 ≤ 18.20.5 Version: 20.18.1 ≤ 20.18.1 Version: 22.13.0 ≤ 22.13.0 Version: 23.6.0 ≤ 23.6.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-23085",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-07T15:50:24.935972Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-401",
                        description: "CWE-401 Missing Release of Memory after Effective Lifetime",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-07T15:57:11.221Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2025-02-25T13:07:47.090Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://lists.debian.org/debian-lts-announce/2025/02/msg00031.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "node",
               vendor: "nodejs",
               versions: [
                  {
                     lessThanOrEqual: "18.20.5",
                     status: "affected",
                     version: "18.20.5",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "20.18.1",
                     status: "affected",
                     version: "20.18.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "22.13.0",
                     status: "affected",
                     version: "22.13.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "23.6.0",
                     status: "affected",
                     version: "23.6.0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.\r\n\r\nThis vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.0",
               },
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-02-07T07:09:25.804Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2025-23085",
      datePublished: "2025-02-07T07:09:25.804Z",
      dateReserved: "2025-01-10T19:05:52.771Z",
      dateUpdated: "2025-02-25T13:07:47.090Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-22150

Vulnerability from cvelistv5

Published

2025-01-21 17:46

Modified

2025-02-12 20:41

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Summary

Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.

References

▼	URL	Tags
	https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975	x_refsource_CONFIRM
	https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0	x_refsource_MISC
	https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a	x_refsource_MISC
	https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385	x_refsource_MISC
	https://hackerone.com/reports/2913312	x_refsource_MISC
	https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f	x_refsource_MISC
	https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	nodejs	undici	Version: >= 4.5.0, < 5.28.5 Version: >= 6.0.0, < 6.21.1 Version: >= 7.0.0, < 7.2.3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-22150",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-21T18:34:22.789606Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-12T20:41:22.041Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "undici",
               vendor: "nodejs",
               versions: [
                  {
                     status: "affected",
                     version: ">= 4.5.0, < 5.28.5",
                  },
                  {
                     status: "affected",
                     version: ">= 6.0.0, < 6.21.1",
                  },
                  {
                     status: "affected",
                     version: ">= 7.0.0, < 7.2.3",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-330",
                     description: "CWE-330: Use of Insufficiently Random Values",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-21T17:46:58.872Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/nodejs/undici/security/advisories/GHSA-c76h-2ccp-4975",
            },
            {
               name: "https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/nodejs/undici/commit/711e20772764c29f6622ddc937c63b6eefdf07d0",
            },
            {
               name: "https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/nodejs/undici/commit/c2d78cd19fe4f4c621424491e26ce299e65e934a",
            },
            {
               name: "https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/nodejs/undici/commit/c3acc6050b781b827d80c86cbbab34f14458d385",
            },
            {
               name: "https://hackerone.com/reports/2913312",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://hackerone.com/reports/2913312",
            },
            {
               name: "https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://blog.securityevaluators.com/hacking-the-javascript-lottery-80cc437e3b7f",
            },
            {
               name: "https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/nodejs/undici/blob/8b06b8250907d92fead664b3368f1d2aa27c1f35/lib/web/fetch/body.js#L113",
            },
         ],
         source: {
            advisory: "GHSA-c76h-2ccp-4975",
            discovery: "UNKNOWN",
         },
         title: "Undici Uses Insufficiently Random Values",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2025-22150",
      datePublished: "2025-01-21T17:46:58.872Z",
      dateReserved: "2024-12-30T03:00:33.654Z",
      dateUpdated: "2025-02-12T20:41:22.041Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2025-23083

Vulnerability from cvelistv5

Published

2025-01-22 01:11

Modified

2025-02-28 13:07

Severity ?

7.7 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.

References

▼	URL	Tags
	https://nodejs.org/en/blog/vulnerability/january-2025-security-releases

Impacted products

	Vendor	Product	Version
	nodejs	node	Version: 20.18.1 ≤ 20.18.1 Version: 22.13.0 ≤ 22.13.0 Version: 23.6.0 ≤ 23.6.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-23083",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-28T04:55:27.327533Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-284",
                        description: "CWE-284 Improper Access Control",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-06T14:09:06.805Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2025-02-28T13:07:33.161Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://security.netapp.com/advisory/ntap-20250228-0008/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "node",
               vendor: "nodejs",
               versions: [
                  {
                     lessThanOrEqual: "20.18.1",
                     status: "affected",
                     version: "20.18.1",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "22.13.0",
                     status: "affected",
                     version: "22.13.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "23.6.0",
                     status: "affected",
                     version: "23.6.0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \r\n\r\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  baseScore: 7.7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.0",
               },
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-22T01:11:30.802Z",
            orgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            shortName: "hackerone",
         },
         references: [
            {
               url: "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
      assignerShortName: "hackerone",
      cveId: "CVE-2025-23083",
      datePublished: "2025-01-22T01:11:30.802Z",
      dateReserved: "2025-01-10T19:05:52.771Z",
      dateUpdated: "2025-02-28T13:07:33.161Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

cve-2025-23085

Vulnerability from cvelistv5

cve-2025-22150

Vulnerability from cvelistv5

cve-2025-23083

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature