CVE-2025-59464
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59464?
CVE-2025-59464 has a medium severity rating due to the potential for remote clients to cause memory leaks.
How do I fix CVE-2025-59464?
To fix CVE-2025-59464, it is recommended to update to the latest version of Node.js that addresses the memory leak in the OpenSSL integration.
What versions of Node.js are affected by CVE-2025-59464?
CVE-2025-59464 affects multiple versions of Node.js that utilize the OpenSSL integration for handling X.509 certificate fields.
Can CVE-2025-59464 affect application performance?
Yes, CVE-2025-59464 can lead to steady memory growth, which may degrade application performance over time.
Is there a workaround for CVE-2025-59464?
Currently, there are no known workarounds for CVE-2025-59464 other than upgrading to a patched version of Node.js.