Threats Tagged 'cve-2025-23167'

A security update for Node.js 20 on Red Hat Enterprise Linux 8 addresses multiple vulnerabilities including a remote crash issue via SignTraits::DeriveBits() (CVE-2025-23166). The update is rated as important by Red Hat Product Security. The advisory covers Red Hat Enterprise Linux 8 on multiple architectures and provides fixes for three CVEs. No CVSS score is provided in the advisory. The update is available and recommended to remediate the identified issues.

A security update for Node.js 20 on Red Hat Enterprise Linux 9 addresses multiple vulnerabilities including a remote crash issue via SignTraits::DeriveBits() (CVE-2025-23166). The update is rated as important by Red Hat Product Security and affects various architectures and extended update support versions of Red Hat Enterprise Linux 9. A patch is available to remediate these issues.

CVE-2025-23167 is a vulnerability in Node.js 20's HTTP parser where HTTP/1 headers can be improperly terminated using '\r\n\rX' instead of the required '\r\n\r\n'. This inconsistency enables HTTP request smuggling, potentially allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The vulnerability affects certain Microsoft products including Azure Linux versions 2.0 and 3.0. No CVSS score or patch information is currently available, and there are no known exploits in the wild at this time.