Worker Thread Exposure in Node.js Affecting Various Versions

CVE-2025-23090

What is CVE-2025-23090?

This vulnerability allows for the hooking of events whenever a worker thread is created within Node.js. It exposes not only standard workers but also internal worker instances. Malicious users can exploit this by accessing the constructor of these internal workers, leading to potential misuse and elevation of privileges among Permission Model users.

References