Vulnerability · Published Jan 20, 2026 · Assigned by hackerone
CVE-2025-59464
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in node from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Official description
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | nodejs | no fix listed | DEBIAN-CVE-2025-59464 |
| Debian:13 | nodejs | no fix listed | DEBIAN-CVE-2025-59464 |
| Debian:14 | nodejs | no fix listed | DEBIAN-CVE-2025-59464 |
| Ubuntu:24.04:LTS | nodejs | no fix listed | UBUNTU-CVE-2025-59464 |
| Ubuntu:25.10 | nodejs | no fix listed | UBUNTU-CVE-2025-59464 |
| Ubuntu:26.04:LTS | nodejs | no fix listed | UBUNTU-CVE-2025-59464 |
| Ubuntu:26.10 | nodejs | no fix listed | UBUNTU-CVE-2025-59464 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H