CVE-2025-23083
CVSS 3.0 Score 7.7 of 10 (high)
Details
Published Jan 22, 2025
Summary
CVE-2025-23083 is a vulnerability in Node.js versions 20, 22, and 23 that allows an attacker to hook into events triggered whenever a worker thread is created using the diagnostics_channel utility. This issue goes beyond just worker threads, exposing internal workers and enabling an attacker to fetch and reinstate their constructors for malicious usage. This vulnerability specifically impacts Permission Model users.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Node.js
Affected Vendors
- OpenJS Foundation