Node.js Security Advisory: CVE-2025-23165/23166/23167 (DoS, Request Smuggling, Crash)

Critical Vulnerability Information 1. Improper Error Handling in Asynchronous Encryption Operations Leading to Process Crash (CVE-2025-23166) - High Description: The method, when executed on a background thread, may incorrectly invoke based on user-provided input. Impact: Affects all active versions (20.x, 22.x, 23.x, 24.x). Allows remote attackers to crash the Node.js runtime. 2. Improper Termination of HTTP Header Blocks (CVE-2025-23167) - Medium Description: The Node.js 20 HTTP parser allows the use of instead of the required to terminate HTTP/1 headers. This could lead to request smuggling, bypassing proxy-based access controls, and submitting unauthorized requests. Impact: Affects only Node.js 20.x versions, prior to upgrading to . 3. Pointer Corruption in When is a String (CVE-2025-23165) - Low Description: During file descriptor setup, a UTF-16 buffer is allocated but then overwritten, causing an unrecoverable memory leak on each call. Repeated use results in unbounded memory growth, eventually leading to a denial of service. Impact: Affects Node.js v20 and v22 versions relying on the API. Summary High Severity Issues: 1 Medium Severity Issues: 1 Low Severity Issues: 1 Affected Ranges 24.x: 1 high severity issue 23.x: 1 high severity issue 22.x: 1 low severity issue, 1 high severity issue 20.x: 1 low severity issue, 1 high severity issue, 1 medium severity issue Release Date New versions will be released on or after May 14, 2025, to address the above issues.

Goal Reached Thanks to every supporter — we hit 100%!

Node.js Security Advisory: CVE-2025-23165/23166/23167 (DoS, Request Smuggling, Crash)