{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-23089", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2025-01-10T19:05:52.772Z", "datePublished": "2025-01-22T01:11:30.822Z", "dateUpdated": "2025-02-10T23:11:06.998Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "NOTE: use of the CVE List to report that a product is unsupported, without reference to a specific defect, is novel and the CVE Program is actively assessing both the validity and potential value of this approach.\r\n\r\nThis CVE has been issued to inform users that they are using End-of-Life (EOL) versions of Node.js. These versions are no longer supported and do not receive updates, including security patches. The continued use of EOL versions may expose systems to potential security risks due to unaddressed software vulnerabilities or dependencies (CWE-1104: Use of Unmaintained Third-Party Components).\r\n\r\nUsers are advised to upgrade to actively supported versions of Node.js to ensure continued security updates and support."}], "affected": [{"defaultStatus": "unaffected", "vendor": "nodejs", "product": "node", "versions": [{"version": "21.7.3", "status": "affected", "lessThanOrEqual": "21.7.3", "versionType": "semver"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "tags": ["disputed"], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-02-05T01:42:36.913Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-01-23T21:21:08.058Z"}, "references": [{"url": "https://endoflife.date/nodejs"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1104", "lang": "en", "description": "CWE-1104 Use of Unmaintained Third Party Components"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-23T17:07:26.435249Z", "id": "CVE-2025-23089", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T23:11:06.998Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://endoflife.date/nodejs"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-01-23T21:21:08.058Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23089", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-23T17:07:26.435249Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1104", "description": "CWE-1104 Use of Unmaintained Third Party Components"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T23:10:56.620Z"}}], "cna": {"tags": ["disputed"], "metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "nodejs", "product": "node", "versions": [{"status": "affected", "version": "21.7.3", "versionType": "semver", "lessThanOrEqual": "21.7.3"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases"}], "descriptions": [{"lang": "en", "value": "NOTE: use of the CVE List to report that a product is unsupported, without reference to a specific defect, is novel and the CVE Program is actively assessing both the validity and potential value of this approach.\r\n\r\nThis CVE has been issued to inform users that they are using End-of-Life (EOL) versions of Node.js. These versions are no longer supported and do not receive updates, including security patches. The continued use of EOL versions may expose systems to potential security risks due to unaddressed software vulnerabilities or dependencies (CWE-1104: Use of Unmaintained Third-Party Components).\r\n\r\nUsers are advised to upgrade to actively supported versions of Node.js to ensure continued security updates and support."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-02-05T01:42:36.913Z"}}}, "cveMetadata": {"cveId": "CVE-2025-23089", "state": "PUBLISHED", "dateUpdated": "2025-02-10T23:11:06.998Z", "dateReserved": "2025-01-10T19:05:52.772Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2025-01-22T01:11:30.822Z", "assignerShortName": "hackerone"}, "dataVersion": "5.1"}

{"cveTags": [{"sourceIdentifier": "support@hackerone.com", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "NOTE: use of the CVE List to report that a product is unsupported, without reference to a specific defect, is novel and the CVE Program is actively assessing both the validity and potential value of this approach.\r\n\r\nThis CVE has been issued to inform users that they are using End-of-Life (EOL) versions of Node.js. These versions are no longer supported and do not receive updates, including security patches. The continued use of EOL versions may expose systems to potential security risks due to unaddressed software vulnerabilities or dependencies (CWE-1104: Use of Unmaintained Third-Party Components).\r\n\r\nUsers are advised to upgrade to actively supported versions of Node.js to ensure continued security updates and support."}, {"lang": "es", "value": "Este CVE se ha emitido para informar a los usuarios que est\u00e1n utilizando versiones de Node.js que han llegado al final de su vida \u00fatil (EOL). Estas versiones ya no reciben soporte y no reciben actualizaciones ni parches de seguridad incluida. El uso continuo de versiones EOL puede exponer los sistemas a posibles riesgos de seguridad debido a vulnerabilidades o dependencias de software no solucionadas (CWE-1104: Uso de componentes de terceros sin mantenimiento). Se recomienda a los usuarios que actualicen a versiones de Node.js que reciban soporte activo para garantizar actualizaciones de seguridad y soporte continuos."}], "id": "CVE-2025-23089", "lastModified": "2025-02-10T23:15:15.960", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "support@hackerone.com", "type": "Secondary"}]}, "published": "2025-01-22T02:15:34.327", "references": [{"source": "support@hackerone.com", "url": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://endoflife.date/nodejs"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1104"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "nodejs: End-of-Life Node.js Versions Pose Security Risks 21.x", "id": "2339391", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339391"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1104", "details": ["NOTE: use of the CVE List to report that a product is unsupported, without reference to a specific defect, is novel and the CVE Program is actively assessing both the validity and potential value of this approach.\nThis CVE has been issued to inform users that they are using End-of-Life (EOL) versions of Node.js. These versions are no longer supported and do not receive updates, including security patches. The continued use of EOL versions may expose systems to potential security risks due to unaddressed software vulnerabilities or dependencies (CWE-1104: Use of Unmaintained Third-Party Components).\nUsers are advised to upgrade to actively supported versions of Node.js to ensure continued security updates and support.", "A flaw was found in Node.js. This vulnerability allows potential exposure to unaddressed software vulnerabilities via the continued use of End-of-Life (EOL) versions that no longer receive security updates or patches."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-23089", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs:18/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "nodejs:20/nodejs", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2025-01-22T01:11:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-23089\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-23089\nhttps://nodejs.org/en/blog/vulnerability/january-2025-security-releases"], "statement": "Red Hat Enterprise Linux is not impacted by this CVE, as it does not include or ship any End-of-Life (EOL) versions of Node.js in its supported repositories. Red Hat ensures that all components provided in its distributions are actively maintained and receive necessary updates, including security patches, to mitigate vulnerabilities and maintain system security.", "threat_severity": "Important"}