CVE-2025-23165: 
npm vulnerability analysis and mitigation

In Node.js, a low severity vulnerability was discovered in May 2025 affecting the ReadFileUtf8 internal binding. The vulnerability specifically impacts Node.js release lines v20 and v22, and was identified and fixed by Justin Nietzel (Node Security).

The vulnerability stems from a corrupted pointer in the node::fs::ReadFileUtf8(const FunctionCallbackInfo& args) function when args[0] is a string. The issue occurs due to a memory management flaw where a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set in uvfss.file. This results in an unrecoverable memory leak that occurs on every function call. The vulnerability has been assigned a CVSS v3.0 base score of 3.7 (Low) with the vector string CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

The primary impact of this vulnerability is a potential denial of service condition through unbounded memory growth. When the affected ReadFileUtf8 API is called repeatedly, it leads to continuous memory leaks that cannot be recovered, eventually consuming system resources (Node Security).

The vulnerability has been addressed in Node.js security releases: v20.19.2, v22.15.1, v23.11.1, and v24.0.2. Users are strongly advised to upgrade to these patched versions to mitigate the vulnerability (Node Security).