GHSA-mjjp-xjfg-97wg (LIEF) found on main

[github-actions]

A new vulnerability for LIEF 0.17.0 was found:
Vulnerability ID: GHSA-mjjp-xjfg-97wg
Vulnerability URL: GHSA-mjjp-xjfg-97wg
Failed run: https://github.com/nodejs/nodejs-dependency-vuln-assessments/actions/runs/29594101003

[RafaelGSS]

The existing update PR nodejs/node#66240 targets main and includes the null check from the upstream fix for CVE-2025-15504 / GHSA-mjjp-xjfg-97wg in deps/LIEF/src/ELF/Parser.tcc. The current bundled code lacks that check.

Node.js calls the affected ELF parser when building single executable applications. Keeping this issue open pending the update; this assessment does not demonstrate a remote runtime exploit.