A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
References
| Link | Resource |
|---|---|
| https://nodejs.org/en/blog/vulnerability/december-2025-security-releases | Release Notes Vendor Advisory |
Configurations
History
30 Jan 2026, 20:26
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | |
| References | () https://nodejs.org/en/blog/vulnerability/december-2025-security-releases - Release Notes, Vendor Advisory | |
| First Time |
Nodejs node.js
Nodejs |
21 Jan 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-400 |
20 Jan 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-20 21:16
Updated : 2026-01-30 20:26
NVD link : CVE-2025-59464
Mitre link : CVE-2025-59464
CVE.ORG link : CVE-2025-59464
JSON object : View
Products Affected
nodejs
- node.js
CWE
CWE-400
Uncontrolled Resource Consumption