UpHeron
All vulnerabilities

Servers and applications

CVE-2025-59464

Memory leak that enables remote Denial of Service against applications processing TLS client certificates

Severity
High 7.5
Published
13 Jan 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
24.12.0, 24.13.0
Sources
NVD, nodejs

Description

A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 24.0.0 before 24.12.0
  • From 24.0.0 before 24.13.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-59464
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59464
  • Node.js security release https://nodejs.org/en/blog/vulnerability/december-2025-security-releases