CVE-2025-27209 - CVE House
Back to Database
Status published High CVE-2025-27209

The V8 release used in Node.js v24.0.0 has changed how...

Vulnerability Description

The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed. * This vulnerability affects Node.js v24.x users.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-27209

Credits & Attribution

No credits recorded in the NVD database.

References

More from nodejs

View All →
CVE-2025-59466
We have identified a bug in Node.js error handling where...
Medium 5.9
CVE-2025-59465
A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data...
High 7.5
CVE-2025-59464
A memory leak in Node.js’s OpenSSL integration occurs when converting...
Medium 6.5
CVE-2025-55132
A flaw in Node.js's permission model allows a file's access...
Low 2.8
CVE-2025-55131
A flaw in Node.js's buffer allocation logic can expose uninitialized...
High 7.1

Affected Vendor

Affected Software

node
Vulnerable Versions:
24.0.0

Timeline

Official Publish: July 18th, 2025
Last Modified: November 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.