CVE-2025-23165: Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.
In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uvfss.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.
Impact: This vulnerability affects APIs relying on ReadFileUtf8 on Node.js release lines: v20 and v22.
Other sources
In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uvfss.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.19.2Fixed in 22.15.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.19.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.15.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2025-23165?
CVE-2025-23165 is rated as a critical severity vulnerability due to the potential for unbounded memory leaks affecting performance.
How do I fix CVE-2025-23165?
To fix CVE-2025-23165, update Node.js to a version later than 22.999.999 or 20.999.999.
Which Node.js versions are affected by CVE-2025-23165?
CVE-2025-23165 affects Node.js versions from 20.0.0 to 20.999.999 and from 22.0.0 to 22.999.999.
What is the impact of not addressing CVE-2025-23165?
Not addressing CVE-2025-23165 can lead to significant performance degradation due to memory leaks.
What type of vulnerability is CVE-2025-23165?
CVE-2025-23165 is a memory leak vulnerability caused by a corrupted pointer in the ReadFileUtf8 internal binding.