Memory Leak Vulnerability in Node.js Affecting Multiple Versions

CVE-2025-23122

What is CVE-2025-23122?

A memory leak occurs in Node.js due to the internal binding in the ReadFileUtf8 function, where a corrupted pointer leads to an allocation of a UTF-16 path buffer that is incorrectly overwritten when setting the file descriptor. This flaw results in an unrecoverable memory leak on each invocation of the function. As the function gets used repeatedly, it can cause unbounded memory growth, severely impacting application performance and leading to potential service disruptions.

References