CVE-2025-32990

What it actually does

The flaw is a heap-buffer-overflow off-by-one error in template parsing logic that performs an out-of-bounds NULL pointer write, resulting in memory corruption and denial-of-service.

Why it matters to the business

Applications or services using the affected package can be crashed by processing malicious template input, leading to service disruption; the issue has been public for over a year with slowly rising exploit prediction scores.

How an attack unfolds

An attacker supplies a specially crafted template file containing trigger settings to the parsing routine; the off-by-one condition is reached during read, causing the NULL write and subsequent crash.

How to fix it

Upgrade @hapi/subtext to version 7.0.3 or 6.1.3.

How to confirm the fix worked

Confirm the installed package version matches a fixed release and re-test template parsing with known trigger inputs to verify absence of crash.

Typical attack path

1. Deliver a malicious template file to the affected parsing component
2. Invoke template processing
3. Trigger the off-by-one buffer overflow
4. Produce memory corruption and application crash

How to detect it

Inspect application and system logs for unexpected crashes or segmentation faults occurring during template file processing; correlate with any inbound untrusted template submissions.

What your security team should do

• Immediately upgrade @hapi/subtext to 7.0.3 or 6.1.3
• Review any services that accept untrusted template input and restrict access until patched
• Monitor application stability logs for related crashes