« Volver al listado

CVE-2025-47153

Estado: AplazadaMedia (6.5)—

Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Libuv — LibuvAINodejs — NodejsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-47153",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-47153",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-01T14:42:34.213508Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "Debian",
          "product": "trixie",
          "versions": [
            {
              "status": "affected",
              "version": "nodejs_0.10.0~dfsg1-1_i386.deb",
              "versionType": "custom",
              "lessThanOrEqual": "nodejs_20.19.0+dfsg-2_i386.deb"
            }
          ],
          "platforms": [
            "i386"
          ],
          "packageName": "nodejs",
          "collectionURL": "https://packages.debian.org",
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-05-01T07:15:58.520",
  "references": [
    {
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076350",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922075",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=892601",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/nodejs/node-v0.x-archive/issues/4549",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/05/02/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00003.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1102"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386."
    },
    {
      "lang": "es",
      "value": "Ciertos procesos de compilación para libuv y Node.js en sistemas de 32 bits, como el paquete binario nodejs hasta nodejs_20.19.0+dfsg-2_i386.deb para Debian GNU/Linux, tienen un tamaño de archivo off_t inconsistente (p. ej., al compilar en Debian i386 siempre se usa _FILE_OFFSET_BITS=64 para la biblioteca dinámica libuv, pero se usa el valor predeterminado del sistema global _FILE_OFFSET_BITS de 32 para nodejs), lo que provoca accesos fuera de los límites. NOTA: Esto no es un problema del software Node.js en sí. En particular, la página de descargas del sitio web de Node.js no ofrece Node.js precompilado para Linux en i386."
    }
  ],
  "lastModified": "2026-06-17T09:27:31.073",
  "sourceIdentifier": "cve@mitre.org"
}