PT-2025-21873 · Node.Js · Node.Js

Published 2025-05-19 · Updated 2025-05-21 · CVE-2025-23122

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Node.js versions v20 and v22

Description: The issue is related to a memory leak in the ReadFileUtf8 internal binding of Node.js, caused by a corrupted pointer in uv fs s.file. This occurs when a UTF-16 path buffer is allocated but then overwritten when the file descriptor is set, resulting in an unrecoverable memory leak on every call. Repeated use can lead to unbounded memory growth, causing a denial of service. This affects APIs that rely on ReadFileUtf8.

Recommendations: For Node.js versions v20 and v22, as a temporary workaround, consider restricting the use of the ReadFileUtf8 internal binding until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BIT-NODE-2025-23122

BIT-NODE-MIN-2025-23122

CVE-2025-23122

Affected Products

Node.Js

References · 7

• https://osv.dev/vulnerability/BIT-node-min-2025-23122 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-2025-23122 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23122 · Security Note
• https://nodejs.org/en/blog/vulnerability/may-2025-security-releases · Note
• https://twitter.com/VulmonFeeds/status/1924303311328453010 · Twitter Post
• https://t.me/cvetracker/24180 · Telegram Post
• https://t.me/cvenotify/122842 · Telegram Post