CVE-2025-59464: 
Node.js vulnerability analysis and mitigation

CVE-2025-59464 is a memory leak vulnerability in Node.js's OpenSSL integration that enables remote denial of service against applications processing TLS client certificates. It was reported via HackerOne, disclosed on January 20, 2026, and affects Node.js 24.x versions from 24.0.0 up to (but not including) 24.12.0. The flaw occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer during calls to socket.getPeerCertificate(true). It carries a CVSS v3.1 base score of 7.5 (High) per NVD, and 6.5 (Medium) per the CNA (HackerOne) (Node.js Advisory, Red Hat).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). Within Node.js's OpenSSL integration, when socket.getPeerCertificate(true) is called, the code converts X.509 certificate fields to UTF-8 strings but fails to free the allocated memory buffer after use, resulting in a per-connection memory leak. An unauthenticated remote client can exploit this by repeatedly establishing TLS connections to a vulnerable server, causing steady, unbounded memory growth. No special privileges or user interaction are required, and the attack vector is entirely network-based (Node.js Advisory, Red Hat Bugzilla).

Successful exploitation causes progressive memory exhaustion on the affected Node.js server, ultimately leading to resource depletion and denial of service. Only availability is impacted — there is no confidentiality or integrity risk. The vulnerability exclusively affects Node.js 24.x applications that invoke socket.getPeerCertificate(true) in their TLS handling code; other active release lines (20.x, 22.x, 25.x) are not affected by this specific CVE (Node.js Advisory).

1. Reconnaissance: Identify internet-facing Node.js 24.x servers (versions 24.0.0–24.11.x) that use mutual TLS (mTLS) or otherwise call socket.getPeerCertificate(true) — these can be identified via service banners, HTTP headers, or application behavior.
2. Establish repeated TLS connections: Using a scripted client (e.g., a simple Node.js or OpenSSL-based script), initiate a high volume of TLS connections to the target server, presenting a valid or self-signed client certificate with multiple X.509 fields (e.g., Subject, Issuer, SAN entries).
3. Trigger memory leak: Each connection that causes the server to call socket.getPeerCertificate(true) internally leaks memory for each certificate field converted to UTF-8. Certificates with many fields amplify the per-connection leak.
4. Sustain pressure: Maintain a steady stream of connections over time to cause cumulative memory growth, eventually exhausting available system memory and causing the Node.js process to become unresponsive or crash (Node.js Advisory).

• Process: Steadily increasing RSS (Resident Set Size) or heap memory usage in the Node.js process over time without a corresponding increase in legitimate workload; memory not reclaimed by garbage collection.
• Logs: High volume of TLS handshake completions from a single or small set of source IPs in application or system logs; repeated short-lived TLS connections in access logs.
• Network: Unusual spike in TLS connection rate from external clients, particularly connections that complete the handshake but transmit minimal application data; connections from unexpected or rotating IP addresses.
• System: OS-level alerts for high memory consumption by the Node.js process; OOM (Out of Memory) killer events in system logs (/var/log/syslog or dmesg) attributable to the Node.js process.

The vulnerability was fixed in Node.js 24.12.0, released as part of the January 13, 2026 security release. Operators running Node.js 24.x should upgrade to version 24.12.0 or later (e.g., 24.13.0 is also available). As interim mitigations while patching, consider implementing TLS connection rate limiting at the load balancer or firewall level, and deploy memory usage monitoring with alerting to detect abnormal growth patterns. Applications that do not require socket.getPeerCertificate(true) should avoid calling it to eliminate exposure (Node.js Advisory, Red Hat Bugzilla).

The vulnerability was covered as part of broader Node.js security release reporting by outlets including CyberSecurityNews, GBHackers, and Endor Labs, which published a technical summary of all eight vulnerabilities fixed in the January 2026 Node.js security release. Endor Labs noted the memory leak as one of several medium-severity issues addressed in the batch release. Community reaction has been measured given the limited scope (only Node.js 24.x) and the absence of public exploits (Endor Labs).