CVE-2025-69418: 
Node.js vulnerability analysis and mitigation

CVE-2025-69418 is an OpenSSL vulnerability involving unencrypted and unauthenticated trailing bytes in the OCB (Offset Codebook) mode when using hardware-accelerated code paths such as AES-NI or ARMv8 CE. When the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions are called directly with inputs whose length is not a multiple of 16 bytes, the trailing 1–15 bytes are left unencrypted and excluded from the authentication tag. Affected OpenSSL versions include 1.1.1 (before 1.1.1ze), 3.0.0–3.0.18, 3.3.0–3.3.5, 3.4.0–3.4.3, 3.5.0–3.5.4, and 3.6.0. The vulnerability was disclosed on January 27, 2026, and carries a CVSS v3.1 base score of 4.0 (Medium) (OpenSSL Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-325 (Missing Cryptographic Step). In the hardware-accelerated stream path of crypto/modes/ocb128.c, after calling ctx->stream() to process full 16-byte blocks, the code failed to advance the in and out buffer pointers by the number of bytes processed. As a result, the subsequent tail-handling code operated on the original base pointers, effectively reprocessing the beginning of the buffer rather than the actual trailing bytes. The authentication checksum was also computed over the wrong data, excluding the true tail bytes from integrity protection. The fix, applied across all affected branches, introduces a processed_bytes variable (num_blocks * 16) and advances both in and out pointers accordingly after the stream call (OpenSSL Commit, Red Hat Bugzilla). The vulnerability only triggers when: (1) the application calls the low-level OCB API directly (not via EVP), (2) the input length is not a multiple of 16 bytes, and (3) the build includes hardware-accelerated AES support.

Successful exploitation allows an attacker with local access to read the trailing 1–15 bytes of an encrypted message in cleartext, bypassing the confidentiality guarantee of OCB mode for those bytes. Additionally, an attacker can tamper with those trailing bytes without detection, as they are excluded from the authentication tag, undermining the integrity guarantee of the AEAD scheme. The impact is limited to applications that directly invoke CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() with non-block-aligned inputs on hardware-accelerated builds; typical EVP-based consumers and TLS implementations are not affected. FIPS modules are also unaffected since OCB is not a FIPS-approved algorithm (Red Hat Bugzilla, OpenSSL Advisory).

Upgrade OpenSSL to one of the following patched versions: 1.1.1ze (premium support customers), 3.0.19, 3.3.6, 3.4.4, 3.5.5, or 3.6.1 (OpenSSL Advisory, Red Hat Bugzilla). As a workaround, audit application code to identify any direct calls to CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() with variable-length inputs and migrate to the higher-level EVP API, which is not affected. If OCB mode is not required, consider switching to an alternative AEAD mode such as AES-GCM. Red Hat has issued errata RHSA-2026:1472 (RHEL 10) and RHSA-2026:1473 (RHEL 9); IBM, FreeBSD, Debian, Ubuntu, SUSE, Alpine, and other distributions have also released corresponding updates.

The vulnerability was notably discovered as part of a batch of 12 OpenSSL CVEs identified by an AI-assisted security research team (Aisle), which attracted significant media attention from outlets including Tom's Hardware, TechRadar, and Heise, praising the quality of the reports and the collaborative disclosure process (Tom's Hardware, TechRadar). The OpenSSL project acknowledged the findings and coordinated patching across all affected branches. Community discussion on oss-security and OpenSSL mailing lists noted the narrow scope of impact, with the OpenSSL team assessing the severity as Low due to the restricted conditions required for exploitation (oss-sec).