3.7
Low
CVE-2025-23165 In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path…
Description
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Impact: * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 22.0 | 22.0 → 22.15.0 | No fix stated |
| Node 21.0 | 21.0 → latest | No fix stated |
| Node 20.0 | 20.0 → 20.19.1 | No fix stated |
| Node 19.0 | 19.0 → latest | No fix stated |
| Node 18.0 | 18.0 → latest | No fix stated |
| Node 17.0 | 17.0 → latest | No fix stated |
| Node 16.0 | 16.0 → latest | No fix stated |
| Node 15.0 | 15.0 → latest | No fix stated |
| Node 14.0 | 14.0 → latest | No fix stated |
Show the 10 other branches Hide the 10 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 13.0 | 13.0 → latest | No fix stated |
| Node 12.0 | 12.0 → latest | No fix stated |
| Node 11.0 | 11.0 → latest | No fix stated |
| Node 10.0 | 10.0 → latest | No fix stated |
| Node 9.0 | 9.0 → latest | No fix stated |
| Node 8.0 | 8.0 → latest | No fix stated |
| Node 7.0 | 7.0 → latest | No fix stated |
| Node 6.0 | 6.0 → latest | No fix stated |
| Node 5.0 | 5.0 → latest | No fix stated |
| Node 4.0 | 4.0 → latest | No fix stated |
References
- nodejs.org nodejs.org
Timeline
- Published
- Last modified
Other CVEs of Node
The 129 CVEs of Node →
CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read…
3.3
Low
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Medium
CVE-2026-106070
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after…
3.7
Low
CVE-2026-106072
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when…
6.7
Medium