Description
Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an inconsistent off_t size (e.g., building on i386 Debian always uses _FILE_OFFSET_BITS=64 for the libuv dynamic library, but uses the _FILE_OFFSET_BITS global system default of 32 for nodejs), leading to out-of-bounds access. NOTE: this is not a problem in the Node.js software itself. In particular, the Node.js website's download page does not offer prebuilt Node.js for Linux on i386.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Debian | trixie | nodejs_0.10.0~dfsg1-1_i386.deb – ≤ nodejs_20.19.0+dfsg-2_i386.deb | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nodejs | 20.19.0+dfsg1-1 | — |
| Debian 13 | nodejs | 20.19.0+dfsg1-1 | — |
| Debian 12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DSA-5991-1 |
| Debian 11 | nodejs | 12.22.12~dfsg-1~deb11u7 | DLA-4152-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | nodejs | No fix yet | — |
| Ubuntu 24.04 LTS | nodejs | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 20.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 18.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 16.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 14.04 LTS | nodejs | No fix yet | — |
Advisories 3
- DSA-5991-1 nodejs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4152-1 nodejs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2025-0915 Debian Linux (libuv und Node.js): Schwachstelle ermöglicht nicht spezifizierten Angriff BSI CERT-Bund (WID) · Aug 31, 2025