AIKIDO-2026-10032
node is vulnerable to Denial of Service (DoS)
50
Medium Risk
This Affects:
nodeTL;DR
Affected versions of the package are vulnerable to a denial-of-service condition due to a memory leak in Node.js’s OpenSSL integration. When converting X.509 certificate fields to UTF-8, allocated buffers are not freed, causing each call to socket.getPeerCertificate(true) to leak memory. A remote client can exploit this by repeatedly establishing TLS connections, leading to unbounded memory growth and eventual resource exhaustion.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
node is vulnerable to Denial of Service (DoS) in versions 25.0.0 - 25.2.0, 23.0.0 - 24.12.0, 21.0.0 - 22.21.1 and 0.0.1 - 20.19.6.
How to fix this
Upgrade the node library to a patch version.
Links
nodejs.org/en/blog/vulnerability/december-2025-security-releases#memory-leak-that-enables-remote-denial-of-service-against-applications-processing-tls-client-certificates-cve-2025-59464---mediumnodejs.org/en/blog/vulnerability/december-2025-security-releases
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant