CVE-2025-59464 Details
Description
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
A memory leak vulnerability has been identified in Node.js's integration with OpenSSL. This issue arises when X.509 certificate fields are converted to UTF-8 without properly freeing the allocated memory. As a result, applications that process TLS client certificates can experience a gradual increase in memory usage, triggered by remote clients through repeated TLS connections. Over time, this memory leak can cause resource exhaustion, leading to a denial-of-service condition.
This vulnerability has been fixed in Node.js version 24.12.0. Users should upgrade to this version or a later release in the 24.x line.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://nodejs.org/en/blog/vulnerability/december-2025-security-releases | [email protected] | Release NotesVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| nodejs node.js | >= 24.0.0, < 24.12.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 30, 2026 | Initial Analysis | [email protected] |
| Jan 21, 2026 | CVE Modified | CISA-ADP |
| Jan 20, 2026 | New CVE Received | [email protected] |