Inconsistent Off_t Size in Libuv and Node.js for 32-bit Debian Systems
CVE-2025-47153
6.5MEDIUM
What is CVE-2025-47153?
Certain build processes for libuv and Node.js on 32-bit systems, particularly for the Node.js binary package on Debian GNU/Linux, exhibit an inconsistent definition of off_t size. Specifically, when built on i386 Debian, the libuv dynamic library utilizes _FILE_OFFSET_BITS=64, while Node.js relies on a system-wide default of 32. This disparity can lead to potential out-of-bounds access, raising security concerns. It is crucial to note that this issue does not arise from the Node.js software itself, as prebuilt versions for 32-bit Linux are not provided on the Node.js download page.
Affected Version(s)
trixie i386 nodejs_0.10.0~dfsg1-1_i386.deb