CVE-2025-59464
Last modified
CVE-2025-59464 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nodejs | Node.Js | >= 24.0.0, < 24.12.0 |
References
- https://nodejs.org/en/blog/vulnerability/december-2025-security-releasesRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-59464?
How severe is CVE-2025-59464?
How do I fix CVE-2025-59464?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59459An attacker that gains SSH access to an unprivileged account…7.5
- CVE-2025-5946Improper Neutralization of Special Elements used in an OS Co…7.2
- CVE-2025-59460The system is deployed in its default state, with configurat…7.5
- CVE-2025-59461A remote unauthenticated attacker may use the unauthenticate…9.8
- CVE-2025-59462An attacker who tampers with the C++ CLI client may crash th…7.5
- CVE-2025-59463An attacker may cause chunk-size mismatches that block file …7.5
- CVE-2025-59465A malformed `HTTP/2 HEADERS` frame with oversized, invalid `…7.5
- CVE-2025-59466We have identified a bug in Node.js error handling where "Ma…7.5
- CVE-2025-59467A Cross-Site Scripting (XSS) vulnerability in the UCRM Argen…9.6
- CVE-2025-59468This vulnerability allows a Backup Administrator to perform …9.1
- CVE-2025-59469This vulnerability allows a Backup or Tape Operator to write…9
- CVE-2025-5947The Service Finder Bookings plugin for WordPress is vulnerab…9.8
Are you affected by CVE-2025-59464?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST