Riskcovery

CVE-2025-23165

State
Published
Severity
3.7 Low
Published
May 19, 2025
Updated
May 28, 2025
Reserved
Jan 12, 2025

Read the record on cve.org

Description

In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.

Impact: * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.

Scores

CVSSScoreVectorSource
3.03.7 LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Lhackerone

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

ProductVersions
nodenodejs
  • 4.0 to before 4.*Affected
  • 5.0 to before 5.*Affected
  • 6.0 to before 6.*Affected
  • 7.0 to before 7.*Affected
  • 8.0 to before 8.*Affected
  • 9.0 to before 9.*Affected
  • 10.0 to before 10.*Affected
  • 11.0 to before 11.*Affected
  • 12.0 to before 12.*Affected
  • 13.0 to before 13.*Affected
  • 14.0 to before 14.*Affected
  • 15.0 to before 15.*Affected
  • 16.0 to before 16.*Affected
  • 17.0 to before 17.*Affected
  • 18.0 to before 18.*Affected
  • 19.0 to before 19.*Affected
  • 20.0 through 20.19.1Affected
  • 22.0 through 22.15.0Affected
  • 21.0 to before 21.*Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.