CVE-2025-47153
MEDIUMDescription
Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.
Is your site exposed to CVE-2025-47153?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
6.5
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Weakness Type (CWE)
CWE-1102
CWE-1102
References
Other References
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076350
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922075
https://bugzilla.redhat.com/show_bug.cgi?id=892601
https://github.com/nodejs/node-v0.x-archive/issues/4549
http://www.openwall.com/lists/oss-security/2025/05/02/2
https://lists.debian.org/debian-lts-announce/2025/05/msg00003.html
Frequently Asked Questions
What is CVE-2025-47153? +
Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386. It has a CVSS v3.1 base score of 6.5 (MEDIUM).
How severe is CVE-2025-47153? +
CVE-2025-47153 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
How do I check if I'm vulnerable to CVE-2025-47153? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.