6.5
Medium
CVE-2025-59464 A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without…
Description
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 24.12 | earliest → < 24.12.0 | 24.12.0 |
Other CVEs of Node
The 129 CVEs of Node →
CVE-2026-105483
A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a…
7.4
High
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Medium
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard…
3.6
Low
CVE-2026-106070
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after…
3.7
Low