VDB
CVE-2025-27209
CVE-2025-27209
PUBLISHED
CVSS 7.5 HIGH
The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed. * This vulnerability affects Node.js v24.x users.
EPSS 1.21% · 67.4th percentile
Risk Scores
CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
1.21%
67.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | node | 24.0.0 |
| Bitnami | node-min | 24.0.0, 24.0.0, 24.0.0 |
| Bitnami | node | 24.0.0, 24.0.0, 24.0.0 |
| Bitnami | node-min | 24.0.0 |
Timeline
- CVE Published
- Jul 15, 2025 PoC Published
- Jul 19, 2025 EPSS Score
- Jul 29, 2025 EPSS Score
- Aug 7, 2025 EPSS Score
- Aug 17, 2025 EPSS Score
- Aug 27, 2025 EPSS Score
- Sep 5, 2025 EPSS Score
- Sep 15, 2025 EPSS Score
- Sep 25, 2025 EPSS Score
- Oct 5, 2025 EPSS Score
- Oct 14, 2025 EPSS Score