Vulnerability · Published May 1, 2025 · Assigned by mitre
CVE-2025-47153
Medium 6.5
In plain English
A medium-severity security flaw in trixie from Debian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DEBIAN-CVE-2025-47153 |
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DSA-5991-1 |
| Debian:13 | nodejs | 20.19.0+dfsg1-1 | DEBIAN-CVE-2025-47153 |
| Debian:14 | nodejs | 20.19.0+dfsg1-1 | DEBIAN-CVE-2025-47153 |
| Ubuntu:24.04:LTS | nodejs | no fix listed | UBUNTU-CVE-2025-47153 |
| Ubuntu:25.10 | nodejs | no fix listed | UBUNTU-CVE-2025-47153 |
Affected products (as reported)
Weakness: CWE-1102 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
References
- https://bugzilla.redhat.com/show_bug.cgi?id=892601
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922075
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076350
- https://github.com/nodejs/node-v0.x-archive/issues/4549
- https://lists.debian.org/debian-lts-announce/2025/05/msg00003.html
- http://www.openwall.com/lists/oss-security/2025/05/02/2