nodejs / nodejs/nodejs-dependency-vuln-assessments
CVE-2025-9230, CVE-2025-9231, CVE-2025-9232 (OpenSSL)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 22
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
Hi, I hope this is the right place to report, as I'm new in this codebase.
The AWS Inspector scanner has picked some vulnerabilities in our application, which seems to affecting the latest v22 and v24 alpine Docker images.
It seems to be the OpenSSL bundled inside node.js. For instance, for the v22 image:
Vulnerability IDs:
https://nvd.nist.gov/vuln/detail/CVE-2025-9230
https://nvd.nist.gov/vuln/detail/CVE-2025-9231
https://nvd.nist.gov/vuln/detail/CVE-2025-9232
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the v22 and v24 Alpine Docker images and verify the reported OpenSSL vulnerabilities in the Node.js bundle. Compare the findings with CVE-2025-9230, CVE-2025-9231, and CVE-2025-9232; done means the affected findings are resolved or their applicability is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100