CVE-2025-59464
Fixed in a distro release EPSS <1%CVSS 6.5
A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | nodejs-20 | 20.20.0-r0 |
| Chainguard | nodejs-20-doc | 20.20.0-r0 |
| Chainguard | nodejs-22 | 22.22.0-r0 |
| Chainguard | nodejs-22-doc | 22.22.0-r0 |
| Chainguard | nodejs-24 | 24.13.0-r0 |
| Chainguard | nodejs-24-doc | 24.13.0-r0 |
| Chainguard | nodejs-25 | 25.3.0-r0 |
| Debian 11 | nodejs | no fix |
| Debian 12 | nodejs | no fix |
| Debian 13 | nodejs | no fix |
| Debian 14 | nodejs | no fix |
| Red Hat hummingbird 1 | nodejs20 | 0:20.20.0-7.1.hum1 |
| Red Hat hummingbird 1 | nodejs20-bin | 0:20.20.0-7.1.hum1 |
| Red Hat hummingbird 1 | nodejs20-devel | 0:20.20.0-7.1.hum1 |
| Red Hat hummingbird 1 | nodejs20-docs | 0:20.20.0-7.1.hum1 |
| Red Hat hummingbird 1 | nodejs20-full-i18n | 0:20.20.0-7.1.hum1 |
| Red Hat hummingbird 1 | nodejs20-libs | 0:20.20.0-7.1.hum1 |
| Red Hat hummingbird 1 | nodejs20-npm | 0:10.8.2-1.20.20.0.7.1.hum1 |
| Red Hat hummingbird 1 | nodejs20-npm-bin | 0:20.20.0-7.1.hum1 |
| Red Hat hummingbird 1 | nodejs22 | 0:22.22.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs22-bin | 0:22.22.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs22-devel | 0:22.22.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs22-docs | 0:22.22.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs22-full-i18n | 0:22.22.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs22-libs | 0:22.22.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs22-npm | 0:10.9.4-1.22.22.0.1.3.hum1 |
| Red Hat hummingbird 1 | nodejs22-npm-bin | 0:22.22.0-1.3.hum1 |
| Red Hat hummingbird 1 | nodejs24 | 0:24.14.1-4.hum1 |
| Red Hat hummingbird 1 | nodejs24 | 0:24.14.1-4.1.hum1 |
| Red Hat hummingbird 1 | nodejs24-bin | 0:24.14.1-4.1.hum1 |
| Red Hat hummingbird 1 | nodejs24-bin | 0:24.14.1-4.hum1 |
| Red Hat hummingbird 1 | nodejs24-devel | 0:24.14.1-4.1.hum1 |
| Red Hat hummingbird 1 | nodejs24-devel | 0:24.14.1-4.hum1 |
| Red Hat hummingbird 1 | nodejs24-docs | 0:24.14.1-4.hum1 |
| Red Hat hummingbird 1 | nodejs24-docs | 0:24.14.1-4.1.hum1 |
| Red Hat hummingbird 1 | nodejs24-full-i18n | 0:24.14.1-4.1.hum1 |
| Red Hat hummingbird 1 | nodejs24-full-i18n | 0:24.14.1-4.hum1 |
| Red Hat hummingbird 1 | nodejs24-libs | 0:24.14.1-4.1.hum1 |
| Red Hat hummingbird 1 | nodejs24-libs | 0:24.14.1-4.hum1 |
| Red Hat hummingbird 1 | nodejs24-npm | 0:11.11.0-1.24.14.1.4.hum1 |
| Red Hat hummingbird 1 | nodejs24-npm | 0:11.11.0-1.24.14.1.4.1.hum1 |
| Red Hat hummingbird 1 | nodejs24-npm-bin | 0:24.14.1-4.hum1 |
| Red Hat hummingbird 1 | nodejs24-npm-bin | 0:24.14.1-4.1.hum1 |
| Red Hat hummingbird 1 | nodejs25 | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25 | 0:25.9.0-1.hum1 |
| Red Hat hummingbird 1 | nodejs25-bin | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-bin | 0:25.9.0-1.hum1 |
| Red Hat hummingbird 1 | nodejs25-devel | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-devel | 0:25.9.0-1.hum1 |
| Red Hat hummingbird 1 | nodejs25-docs | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-docs | 0:25.9.0-1.hum1 |
| Red Hat hummingbird 1 | nodejs25-full-i18n | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-full-i18n | 0:25.9.0-1.hum1 |
| Red Hat hummingbird 1 | nodejs25-libs | 0:25.9.0-1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-libs | 0:25.9.0-1.hum1 |
| Red Hat hummingbird 1 | nodejs25-npm | 0:11.12.1-1.25.9.0.1.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-npm | 0:11.12.1-1.25.9.0.1.hum1 |
| Red Hat hummingbird 1 | nodejs25-npm-bin | 0:25.9.0-1.hum1 |
| Red Hat hummingbird 1 | nodejs25-npm-bin | 0:25.9.0-1.1.hum1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP7 | nodejs24 | 24.14.1-150700.15.8.1 |
| SUSE Linux Enterprise Server 16.0 | nodejs24 | 24.14.1-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | nodejs24 | 24.14.1-160000.1.1 |
| Ubuntu 24.04 LTS | nodejs | no fix |
| Ubuntu 25.10 | nodejs | no fix |
| Ubuntu 26.04 LTS | nodejs | no fix |
| Ubuntu 26.10 | nodejs | no fix |
| Ubuntu Pro 14.04 LTS | nodejs | no fix |
| Ubuntu Pro 16.04 LTS | nodejs | no fix |
| Ubuntu Pro 18.04 LTS | nodejs | no fix |
| Ubuntu Pro 20.04 LTS | nodejs | no fix |
| Ubuntu Pro 22.04 LTS | nodejs | no fix |
| Wolfi | nodejs-20 | 20.20.0-r0 |
| Wolfi | nodejs-20-doc | 20.20.0-r0 |
| Wolfi | nodejs-22 | 22.22.0-r0 |
| Wolfi | nodejs-22-doc | 22.22.0-r0 |
| Wolfi | nodejs-24 | 24.13.0-r0 |
| Wolfi | nodejs-24-doc | 24.13.0-r0 |
| Wolfi | nodejs-25 | 25.3.0-r0 |
| openSUSE Leap 16.0 | nodejs24 | 24.14.1-160000.1.1 |
| openSUSE Tumbleweed | nodejs24 | 24.13.0-4.1 |
| openSUSE Tumbleweed | nodejs26 | 26.3.1-1.1 |