OpenSSL has recently addressed a comprehensive set of security vulnerabilities, revealing patches for a total of 13 issues. Notably, two significant vulnerabilities have been identified as CVE-2025-15467 and CVE-2025-11187.
CVE-2025-15467 is a high-risk vulnerability involving a stack buffer overflow during the parsing of CMS AuthEnvelopedData, which could potentially result in remote code execution. On the other hand, CVE-2025-11187 poses a medium risk due to the lack of PKCS#12 PBMAC1 parameter validation, which may lead to a stack-based buffer overflow.
These vulnerabilities affect OpenSSL versions ranging from 1.0.2 to 3.6, spanning a broad period from 2002 to 2026. While many vulnerabilities contribute to potential denial of service scenarios, a select few also open pathways for remote code execution.
A particular note for Deepin users: Upgrading to version 3.2.4-0deepin6 or higher is recommended to ensure system security. Users should execute the <code>apt update</code> and <code>upgrade</code> commands for a seamless update process. Deepin’s swift response within 48 hours post-initial advisory highlights their commitment to security, culminating in successful patch adaptation and testing processes before repository release.
The vulnerabilities are mostly pertinent to applications handling untrusted cryptographic files and TLS configurations, but it’s important to note the exceptions — specifically, the FIPS modules are unaffected by the majority of these issues.
For Node.js users, three CVEs of low to moderate severity have been disclosed. The vulnerabilities particularly impact PFX (PKCS#12) file processing used in TLS configurations. OpenSSL version 3.5.4 and later is affected by CVE-2025-11187, while CVE-2025-69421 and CVE-2026-22795 of low severity affect all Node.js branches. Given the limited attack surface, these issues will be included in regular Node.js releases rather than standalone security updates.
As these patches are crucial in maintaining optimal security standards, it is recommended that all users of affected versions apply the latest updates provided by OpenSSL across various platforms. Ensuring your systems are up-to-date will mitigate the risks posed by these vulnerabilities.

Collections

OpenSSL released patches for 13 security vulnerabilities, including two critical issues: CVE-2025-15467 (high-risk stack buffer overflow enabling potential remote code execution) and CVE-2025-11187 (medium-risk buffer overflow from PKCS#12 validation failure). The vulnerabilities affect OpenSSL versions 1.0.2 through 3.6 and primarily impact applications handling untrusted cryptographic files and TLS configurations. Node.js users face three low-to-moderate severity CVEs affecting PFX file processing. Users should update to the latest OpenSSL versions immediately, with Deepin users specifically advised to upgrade to version 3.2.4-0deepin6 or higher.

OpenSSL Vulnerabilities and Their Impact on Node.js