CVE-2025-23122

20 May 2025, 22:15

Type	Values Removed	Values Added
References	{'url': 'https://nodejs.org/en/blog/vulnerability/may-2025-security-releases', 'source': 'support@hackerone.com'}
CWE	CWE-401
Summary	(en) In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service. Impact: * This vulnerability affects APIs relying on `ReadFileUtf8` on Node.js release lines: v20 and v22.	(en) Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23165.
CVSS	v2 : unknown v3 : 3.7	v2 : unknown v3 : unknown

---

19 May 2025, 14:15

Type	Values Removed	Values Added
CWE		CWE-401

---

19 May 2025, 02:15

Type	Values Removed	Values Added
New CVE

---