CVE-2025-47153: Out-of-Bounds Access in Node.js

The out-of-bounds access vulnerability allows attackers to potentially trigger a denial-of-service (DoS) condition or, in more complex scenarios, achieve arbitrary code execution. While the vulnerability isn't inherent to the Node.js software itself, a malicious actor could exploit it during the build or deployment process, particularly if they control the build environment or can inject malicious code into the build pipeline. The impact is amplified in environments where Node.js applications are built and deployed automatically, as this could allow attackers to compromise the entire system. This vulnerability is similar to other memory corruption issues that have been exploited to gain control of systems.

1. Reserved2025-05-01
2. Published2025-05-01
3. Modified2025-05-02
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-47153 is to upgrade Node.js to version 20.19.1 or later. If upgrading is not immediately feasible due to compatibility constraints or breaking changes, consider temporarily isolating affected systems and limiting network access. While a direct WAF rule is unlikely to be effective, monitoring build processes for unusual activity and ensuring the integrity of build dependencies can help detect potential exploitation attempts. Review build scripts and configurations for any suspicious modifications. After upgrading, confirm the fix by attempting to build Node.js on an i386 Debian system and verifying that the off_t size is handled consistently.