CVE-2025-47153: Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-1_i386.deb for...
Description
Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-1_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.
Classification
CVE ID: CVE-2025-47153
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.5
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Affected Products
Vendor: Debian
Product: trixie
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.11% (probability of being exploited)
EPSS Percentile: 30.65% (scored less or equal to compared to others)
EPSS Date: 2025-05-30 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: none
SSVC Technical Impact: partial
SSVC Automatable: false
References
https://nvd.nist.gov/vuln/detail/CVE-2025-47153https://bugzilla.redhat.com/show_bug.cgi?id=892601
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922075
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076350
https://github.com/nodejs/node-v0.x-archive/issues/4549