Memory Leak Vulnerability in Node.js - CVE-2025-23165
Summary
CVE-2025-23165: In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. Affects nodejs versions < 22.15.1-r0. Fixed in 22.15.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The affected versions, v20 and v22, utilize the ReadFileUtf8 internal binding, which is responsible for reading files with UTF-8 encoding. This functionality is critical for applications that handle file I/O operations, making it essential to address any vulnerabilities that may compromise performance or security.
Vulnerability Detail
CVE-2025-23165 is a memory leak vulnerability in Node.js caused by a corrupted pointer in the uv_fs_s.file structure. When a UTF-16 path buffer is allocated, it is subsequently overwritten when the file descriptor is set, leading to an unrecoverable memory leak on each call to ReadFileUtf8. This can result in unbounded memory growth, ultimately causing a denial of service as the application consumes excessive memory resources. The vulnerability affects APIs that rely on ReadFileUtf8 in Node.js versions v20 and v22.
How To Fix
Minimum fixed version
22.15.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of the ReadFileUtf8 API in your application until a patched version of Node.js is available. Instead, you can use alternative file reading methods that do not rely on this vulnerable API.
Conclusion
CVE-2025-23165 is a critical memory leak vulnerability in Node.js that can lead to denial of service. It is essential for developers to update their Node.js installations to patched versions and consider workarounds if immediate updates are not feasible. Monitoring tools like Vulert can help keep applications secure by providing real-time alerts for vulnerabilities.
See every vulnerability recorded for nodejs →
FAQ
CVE-2025-23165 is a memory leak vulnerability in Node.js that affects the ReadFileUtf8 internal binding, leading to potential denial of service due to unbounded memory growth.
The vulnerability affects Node.js versions v20 and v22.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If you cannot update Node.js right away, avoid using the ReadFileUtf8 API and consider using alternative file reading methods as a temporary workaround.
More information about CVE-2025-23165 can be found in the official CVE database and security advisories related to Node.js.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
