CVE-2025-59464
Description
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
CWE
- CWE-400 — CWE-400 Uncontrolled Resource Consumption
Affected
- nodejs / node — v=24.12.0 <24.12.0 [affected]
CVSS
- 3.0 score=6.5 severity=MEDIUM
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
Source
cvelistV5-main/cves/2025/59xxx/CVE-2025-59464.json