VULNERABILITY INTELLIGENCE
CVE-2025-23165
CVSS score3.7 LOW
EPSS probability0.56%
CISA KEVNot currently listed
Published2025-05-19
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Impact: * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-401