What’s Vulnerable › Vulnerabilities
CVE-2025-59464
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-01-20 · updated 2026-06-17
- Weakness: CWE-400
Description
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
Affected products
- Node.js: from 24.0.0 before 24.12.0 — fixed in 24.12.0
How to fix
Upgrade to a fixed version: Node.js 24.12.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-59464 or the next vulnerability affects your stack