CVE-2025-59464

A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nodejs.org/en/blog/vulnerability/december-2025-security-releases	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

History

17 Jun 2026, 09:46

Type	Values Removed	Values Added
Summary		(es) Una fuga de memoria en la integración de OpenSSL de Node.js ocurre al convertir campos de certificado 'X.509' a UTF-8 sin liberar el búfer asignado. Cuando las aplicaciones llaman a 'socket.getPeerCertificate(true)', cada campo de certificado fuga memoria, permitiendo a clientes remotos desencadenar un crecimiento constante de la memoria a través de conexiones TLS repetidas. Con el tiempo, esto puede llevar al agotamiento de recursos y a la denegación de servicio.

30 Jan 2026, 20:26

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~6.5~~	v2 : unknown v3 : 7.5
CPE		cpe:2.3:a:nodejs:node.js:::::-:::*
References	~~() https://nodejs.org/en/blog/vulnerability/december-2025-security-releases -~~	() https://nodejs.org/en/blog/vulnerability/december-2025-security-releases - Release Notes, Vendor Advisory
First Time		Nodejs node.js Nodejs

21 Jan 2026, 21:16

Type	Values Removed	Values Added
CWE		CWE-400

20 Jan 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-20 21:16

Updated : 2026-06-17 09:46

NVD link : CVE-2025-59464

Mitre link : CVE-2025-59464

CVE.ORG link : CVE-2025-59464

JSON object : View

Products Affected

nodejs

node.js

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2025-59464", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59464", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T20:40:07.879640Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "nodejs", "product": "node", "versions": [{"status": "affected", "version": "24.12.0", "lessThan": "24.12.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-20T21:16:03.900", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", "tags": ["Release Notes", "Vendor Advisory"], "source": "support@hackerone.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "A memory leak in Node.js\u2019s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service."}, {"lang": "es", "value": "Una fuga de memoria en la integraci\u00f3n de OpenSSL de Node.js ocurre al convertir campos de certificado 'X.509' a UTF-8 sin liberar el b\u00fafer asignado. Cuando las aplicaciones llaman a 'socket.getPeerCertificate(true)', cada campo de certificado fuga memoria, permitiendo a clientes remotos desencadenar un crecimiento constante de la memoria a trav\u00e9s de conexiones TLS repetidas. Con el tiempo, esto puede llevar al agotamiento de recursos y a la denegaci\u00f3n de servicio."}], "lastModified": "2026-06-17T09:46:12.450", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "C2C21118-9E06-473D-8287-10F2181A067B", "versionEndExcluding": "24.12.0", "versionStartIncluding": "24.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}