CVE-2025-47153: Node.js Buffer Overflow Vulnerability

CVE-2025-47153 Overview

CVE-2025-47153 describes an out-of-bounds access condition caused by inconsistent off_t sizing between libuv and Node.js when built for 32-bit systems. The issue affects downstream packaging such as the Debian nodejs_20.19.0+dfsg-2_i386.deb binary package for i386. The libuv dynamic library is compiled with _FILE_OFFSET_BITS=64, while nodejs uses the system default of _FILE_OFFSET_BITS=32. This ABI mismatch causes structures crossing the library boundary to be interpreted with different offsets, producing out-of-bounds memory access [CWE-1102].

Critical Impact
The mismatch between 32-bit and 64-bit off_t types on i386 builds can trigger out-of-bounds access across the libuv/Node.js boundary, affecting confidentiality, integrity, and availability.

Affected Products

Debian GNU/Linux nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb
Downstream 32-bit builds of Node.js linked against libuv compiled with _FILE_OFFSET_BITS=64
libuv dynamic library builds on i386 Debian where global _FILE_OFFSET_BITS defaults differ from library defaults

Discovery Timeline

2025-05-01 - CVE-2025-47153 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47153

Vulnerability Analysis

The vulnerability is a packaging and build-system defect classified under [CWE-1102] (Reliance on Machine-Dependent Data Representation). On 32-bit Linux systems, the off_t type used for file offsets can be either 32 or 64 bits depending on the _FILE_OFFSET_BITS preprocessor macro. When two linked components disagree on this width, any struct passing across their boundary is laid out inconsistently. Fields shift, sizes mismatch, and reads or writes land outside the intended memory region.

The NVD entry clarifies that upstream Node.js is not itself vulnerable. The Node.js project does not distribute prebuilt Linux i386 binaries. The defect arises when distribution packagers compile libuv with 64-bit file offsets while leaving Node.js at the default 32-bit width, or vice versa.

Root Cause

The root cause is an inconsistent value of the _FILE_OFFSET_BITS macro between two components that share ABI. Building libuv with _FILE_OFFSET_BITS=64 changes the size and layout of any struct containing an off_t member. Node.js compiled with the platform default of _FILE_OFFSET_BITS=32 on i386 then calls into libuv with structs sized for 32-bit offsets. The receiving code reads past the caller's allocation, producing out-of-bounds access.

Attack Vector

Exploitation requires triggering libuv file-related APIs in Node.js on an affected 32-bit build. The attacker must supply input processed by file operations that cross the ABI boundary. Attack complexity is high because the condition depends on specific packaging, memory layout, and reachable code paths. The vulnerability manifests through normal Node.js file system operations rather than a novel injection technique. Refer to the Debian Bug Report #1076350 and the Debian LTS Announcement for details on how affected packages surface the flaw.

Detection Methods for CVE-2025-47153

Indicators of Compromise

Node.js processes on i386 systems crashing with SIGSEGV or unexpected memory faults during file operations
Anomalous behavior in libuv-backed I/O such as truncated reads, corrupted buffers, or invalid file offset values
Presence of the Debian nodejs_20.19.0+dfsg-2_i386.deb package or equivalent 32-bit builds on production hosts

Detection Strategies

Inventory all Node.js installations and identify hosts running 32-bit (i386) architectures
Inspect build flags of installed libuv and nodejs binaries using dpkg -s and package build logs to compare _FILE_OFFSET_BITS settings
Correlate process crash telemetry from EDR agents with Node.js runtime versions on 32-bit hosts

Monitoring Recommendations

Alert on repeated crashes of node processes on i386 hosts, particularly during file I/O syscalls
Track package installations of nodejs and libuv on Debian-based systems and flag mismatched ABI builds
Log kernel SIGSEGV and SIGBUS signals delivered to Node.js processes for post-incident analysis

How to Mitigate CVE-2025-47153

Immediate Actions Required

Migrate Node.js workloads off 32-bit i386 platforms where feasible; 64-bit builds are not affected by this ABI mismatch
Apply the fixed packages announced in the Debian LTS Announcement on affected Debian systems
Audit third-party 32-bit Node.js builds and confirm consistent _FILE_OFFSET_BITS across libuv and nodejs

Patch Information

Distribution maintainers must rebuild nodejs and libuv with consistent _FILE_OFFSET_BITS values on 32-bit targets. Debian addressed the packaging defect through updates tracked in Debian Bug Report #1076350 and the associated LTS advisory. Upstream Node.js is not affected, and the Node.js download page does not offer prebuilt i386 Linux binaries. Consult the OpenWall OSS Security Discussion for the technical disclosure thread.

Workarounds

Rebuild Node.js from source on i386 with CPPFLAGS="-D_FILE_OFFSET_BITS=64" to match the libuv ABI
Switch to 64-bit (amd64) Node.js packages, which are not affected by the offset-width inconsistency
Restrict Node.js file I/O paths that consume attacker-controlled data until patched packages are deployed

bash

# Verify architecture and package versions on Debian hosts
dpkg --print-architecture
dpkg -s nodejs libuv1 | grep -E 'Package|Version|Architecture'

# Rebuild Node.js on i386 with matching file-offset ABI
export CPPFLAGS="-D_FILE_OFFSET_BITS=64"
./configure && make -j"$(nproc)"