These vulnerabilities allow potential exposure to unaddressed software vulnerabilities via the continued use of End-of-Life (EOL) versions that no longer receive security updates or patches.

• CVE-2025-23087 (Node.js v17.x and earlier): This critical vulnerability affects outdated Node.js versions (v17.x and prior), potentially allowing attackers to gain unauthorized access due to inadequate security mechanisms.
• CVE-2025-23088 (Node.js v19.x): A severe flaw in Node.js v19.x enables attackers to bypass security protections and execute arbitrary code.
• CVE-2025-23089 (Node.js v21.x): This vulnerability, like CVE-2025-23088, affects Node.js v21.x and arises from insufficient access controls, making exploitation possible.

Apart from the critical vulnerabilities, there are three vulnerabilities of lower severity:

• CVE-2025-23083 (Worker Permission Bypass): A high-severity vulnerability in Node.js v20.x, v22.x, and v23.x, where an attacker can exploit an internal worker leak through the diagnostics_channel utility. This could grant unauthorized access to restricted worker threads, potentially escalating privileges.
• CVE-2025-23084 (Path Traversal on Windows): A medium-severity vulnerability affecting Node.js on Windows, where improper handling of drive names allows attackers to bypass path restrictions and access unauthorized directories.
• CVE-2025-23085 (GOAWAY HTTP/2 Memory Leak): A memory leak issue impacting Node.js v18.x, v20.x, v22.x, and v23.x, occurring when a remote peer closes a socket without sending a GOAWAY signal. This flaw may lead to excessive resource consumption and potential denial-of-service (DoS) conditions.