Memory leak in Node.js - CVE-2025-23165

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU109243

Memory leak in Node.js - CVE-2025-23165

Published: May 16, 2025


Vulnerability identifier: #VU109243
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-23165
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in ReadFileUtf8 caused by a corrupted pointer. A remote attacker can force the application to leak memory and perform denial of service attack.


Affected software

Node.js
Arch Linux
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Anolis OS
Web and Scripting Module
openSUSE Leap
openEuler
Fedora
Netcool Operations Insight
EasyApache
IBM Business Automation Workflow
IBM Documentation Offline
IBM App Connect Enterprise
nodejs-nodemon
npm
v8-devel
nodejs-debugsource
nodejs-docs
nodejs-devel
nodejs-full-i18n
nodejs-libs
nodejs-debuginfo
nodejs
nodejs-lts-iron
nodejs20
nodejs20-debuginfo
corepack20
nodejs20-devel
nodejs20-docs
npm20
nodejs20-debugsource
nodejs-lts-jod
nodejs22
nodejs22-docs
nodejs22-debuginfo
npm22
nodejs22-devel
nodejs22-debugsource
corepack22
nodejs-packaging-bundler
nodejs-packaging

How to mitigate CVE-2025-23165

Install updates from vendor's website.

Node.js - addressed in versions 20.19.2, 22.15.1
Netcool Operations Insight - update to 1.6.15
EasyApache - update to 4 25-16
IBM App Connect Enterprise - addressed in versions 12.0.12.16, 13.0.4.1
IBM Documentation Offline - update to 1.2.0
nodejs-nodemon - update to 3.0.1-1
npm - update to 10.8.2-1.20.18.2.3
npm - update to 10.8.2-1.20.19.2.1
v8-devel - update to 11.3.244.8-1.20.18.2.3
nodejs-debugsource - update to 20.18.2-3
nodejs-docs - update to 20.18.2-3
nodejs-devel - update to 20.18.2-3
nodejs-full-i18n - update to 20.18.2-3
nodejs-libs - update to 20.18.2-3
nodejs-debuginfo - update to 20.18.2-3
nodejs - update to 20.18.2-3
nodejs-lts-iron - update to 20.19.2-1
nodejs-docs - update to 20.19.2-1
nodejs-full-i18n - update to 20.19.2-1
nodejs-devel - update to 20.19.2-1
nodejs - update to 20.19.2-1
nodejs20 - addressed in versions 20.19.2-1.fc41, 20.19.2-1.fc42
nodejs20-debuginfo - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
corepack20 - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
nodejs20-devel - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
nodejs20-docs - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
npm20 - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
nodejs20 - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
nodejs20-debugsource - addressed in versions 20.19.2-150500.11.21.1, 20.19.2-150600.3.12.1
nodejs-lts-jod - update to 22.15.1-1
nodejs22 - addressed in versions 22.15.1-1.fc41, 22.15.1-1.fc42
nodejs22-docs - addressed in versions 22.15.1-150600.13.9.1, 22.15.1-150700.3.3.1
nodejs22-debuginfo - addressed in versions 22.15.1-150600.13.9.1, 22.15.1-150700.3.3.1
nodejs22 - addressed in versions 22.15.1-150600.13.9.1, 22.15.1-150700.3.3.1
npm22 - addressed in versions 22.15.1-150600.13.9.1, 22.15.1-150700.3.3.1
nodejs22-devel - addressed in versions 22.15.1-150600.13.9.1, 22.15.1-150700.3.3.1
nodejs22-debugsource - addressed in versions 22.15.1-150600.13.9.1, 22.15.1-150700.3.3.1
corepack22 - update to 22.15.1-150600.13.9.1
nodejs-packaging-bundler - update to 2021.06-4
nodejs-packaging - update to 2021.06-4

External References

Related Security Bulletins