BaseFortify

Publication date: 2026-01-20

Last updated on: 2026-01-30

Assigner: HackerOne

Description

A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-20

Last Modified

2026-01-30

Generated

2026-07-06

AI Q&A

2026-01-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-59464

Affected Vendors & Products

Vendor	Product	Version / Range
nodejs	node.js	From 24.0.0 (inc) to 24.12.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a memory leak in Node.js's OpenSSL integration that happens when converting X.509 certificate fields to UTF-8. The allocated memory buffer is not freed properly. When applications call socket.getPeerCertificate(true), each certificate field leaks memory, allowing remote clients to cause continuous memory growth by making repeated TLS connections.

Impact Analysis

The vulnerability can lead to resource exhaustion and denial of service because the memory leak causes steady memory growth when exploited by remote clients through repeated TLS connections.

Hi! I’m here to help you understand CVE-2025-59464. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70