CVE-2025-47153

NameCVE-2025-47153
DescriptionCertain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4152-1
Debian Bugs922075, 1076350

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nodejs (PTS)bullseye12.22.12~dfsg-1~deb11u4vulnerable
bullseye (security)12.22.12~dfsg-1~deb11u7fixed
bookworm18.19.0+dfsg-6~deb12u2vulnerable
bookworm (security)18.19.0+dfsg-6~deb12u1vulnerable
trixie20.19.0+dfsg1-1fixed
sid20.19.2+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nodejssourcebullseye12.22.12~dfsg-1~deb11u7DLA-4152-1
nodejssource(unstable)20.19.0+dfsg1-1922075, 1076350

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=892601
https://github.com/nodejs/node-v0.x-archive/issues/4549

Search for package or bug name: Reporting problems