U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Vulnerability Change Records for CVE-2025-47153

Change History

New CVE Received from MITRE 5/01/2025 3:15:58 AM

Action Type Old Value New Value
Added Description

								
							
							
						
Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-1_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.
Added Reference

								
							
							
						
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076350
Added Reference

								
							
							
						
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922075
Added Reference

								
							
							
						
https://bugzilla.redhat.com/show_bug.cgi?id=892601
Added Reference

								
							
							
						
https://github.com/nodejs/node-v0.x-archive/issues/4549