Test ID:	1.3.6.1.4.1.25623.1.0.153854
Category:	General
Title:	Node.js 20.x < 20.18.2, 21.x < 22.13.1, 23.x < 23.6.1 Worker Permission Bypass Vulnerability - Windows
Summary:	Node.js is prone to a worker permission bypass; vulnerability via InternalWorker leak in diagnostics.
Description:	Summary: Node.js is prone to a worker permission bypass vulnerability via InternalWorker leak in diagnostics. Vulnerability Insight: With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. Affected Software/OS: Node.js version 20.x through 23.x. Solution: Update to version 20.18.2, 22.13.1, 23.6.1 or later. CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2025-23083
Copyright	Copyright (C) 2025 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.