CVE-2025-59464: Memory leak that enables remote Denial of Service against applications processing TLS client certificates
A memory leak in Node.js’s OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. When applications call socket.getPeerCertificate(true), each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
Other sources
A memory leak in Node.js’s OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. When applications call socket.getPeerCertificate(true), each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
This vulnerability was already fixed on Node.js 24.12.0. It has no impact on other active release lines.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.0Fixed in 22.22.0Fixed in 24.13.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.13.0 - Upgrade
Upgrade
Node.jsto a version that resolves this vulnerability.Fixed in 24.12.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2025-59464?
CVE-2025-59464 has a medium severity rating due to the potential for remote clients to cause memory leaks.
How do I fix CVE-2025-59464?
To fix CVE-2025-59464, it is recommended to update to the latest version of Node.js that addresses the memory leak in the OpenSSL integration.
What versions of Node.js are affected by CVE-2025-59464?
CVE-2025-59464 affects multiple versions of Node.js that utilize the OpenSSL integration for handling X.509 certificate fields.
Can CVE-2025-59464 affect application performance?
Yes, CVE-2025-59464 can lead to steady memory growth, which may degrade application performance over time.
Is there a workaround for CVE-2025-59464?
Currently, there are no known workarounds for CVE-2025-59464 other than upgrading to a patched version of Node.js.