CVE-2025-59464
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Jan 20, 2026
CISA due date
—
The record
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | node | 24.0.0 | 24.12.0 |
| Bitnami | node-min | 24.0.0 | 24.12.0 |
| Chainguard | nodejs-20 | 0 | 20.20.0-r0 |
| Chainguard | nodejs-20-doc | 0 | 20.20.0-r0 |
| Chainguard | nodejs-22 | 0 | 22.22.0-r0 |
| Chainguard | nodejs-22-doc | 0 | 22.22.0-r0 |
| Chainguard | nodejs-24 | 0 | 24.13.0-r0 |
| Chainguard | nodejs-24-doc | 0 | 24.13.0-r0 |
| Chainguard | nodejs-25 | 0 | 25.3.0-r0 |
| Wolfi | nodejs-20 | 0 | 20.20.0-r0 |
| Wolfi | nodejs-20-doc | 0 | 20.20.0-r0 |
| Wolfi | nodejs-22 | 0 | 22.22.0-r0 |
| Wolfi | nodejs-22-doc | 0 | 22.22.0-r0 |
| Wolfi | nodejs-24 | 0 | 24.13.0-r0 |
| Wolfi | nodejs-24-doc | 0 | 24.13.0-r0 |
| Wolfi | nodejs-25 | 0 | 25.3.0-r0 |
| openSUSE:Leap 16.0 | nodejs24 | 0 | 24.14.1-160000.1.1 |
| openSUSE:Tumbleweed | nodejs24 | 0 | 24.13.0-4.1 |
| openSUSE:Tumbleweed | nodejs26 | 0 | 26.3.1-1.1 |
Related vulnerabilities
- CVE-2025-59465 A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js… Also affects node
- CVE-2025-59466 We have identified a bug in Node.js error handling where "Maximum call stack size… Also affects node
- CVE-2025-55132 A flaw in Node.js's permission model allows a file's access and modification timestamps… Also affects node
- CVE-2025-55131 A flaw in Node.js's buffer allocation logic can expose uninitialized memory when… Also affects node
- CVE-2025-55130 A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and… Also affects node
- HSEC-2024-0003 process: command injection via argument list on Windows Also affects node
- CVE-2025-27210 An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically… Also affects node
- CVE-2025-23085 A memory leak could occur when a remote peer abruptly closes the socket without sending a… Also affects node