Threats Tagged 'cve-2025-59464'

This update includes the following RPMs:

Multiple security vulnerabilities have been identified in the Node.js 22 package distributed with Red Hat Enterprise Linux 10.0 Extended Update Support. These include a denial of service, uninitialized memory exposure, and file permissions bypass issues. Red Hat has issued an important security advisory (RHSA-2026:2899) addressing these vulnerabilities with updated packages. The vulnerabilities affect Node.js 22.22.0-1.el10_0 across multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores are provided in the advisory. The update is available and should be applied to remediate these issues.

A memory leak vulnerability exists in Node.js's OpenSSL integration when converting X.509 certificate fields to UTF-8. This occurs because the allocated buffer is not freed during the conversion process. Applications invoking socket.getPeerCertificate(true) leak memory for each certificate field, which can be exploited by remote clients to cause steady memory growth through repeated TLS connections. Over time, this can lead to resource exhaustion and denial of service. The issue affects Node.js versions from 24.0.0 up to but not including 24.12.0. A patch is available to address this vulnerability.

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

CVE-2025-59464 is a medium severity memory leak vulnerability in Node.js version 24.12.0 affecting its OpenSSL integration. The flaw occurs when converting X.509 certificate fields to UTF-8 during calls to socket.getPeerCertificate(true), where allocated buffers are not freed. Remote clients can exploit this by repeatedly initiating TLS connections, causing steady memory growth and potential resource exhaustion leading to denial of service. No known exploits are currently reported in the wild. The vulnerability requires no authentication but does require user interaction via TLS connections.

MediumVulnerabilityGermanyFranceNetherlands+4#cve#cve-2025-59464