Memory Leak Vulnerability in Node.js Affects Version 20 and 22

CVE-2025-23165

What is CVE-2025-23165?

A memory leak vulnerability exists in Node.js, specifically in the ReadFileUtf8 internal binding. This issue arises due to a corrupted pointer in uv_fs_s.file, which leads to an allocated UTF-16 path buffer being overwritten when the file descriptor is being set. The result is an unrecoverable memory leak that occurs with every invocation of the method, potentially leading to unbounded memory growth over time. APIs that rely on ReadFileUtf8 in Node.js versions 20 and 22 may experience performance degradation and service interruptions due to this vulnerability.

References