CVE-2025-23122
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in ...
CVE-2025-23122 has been rejected by its source and should not be treated as a live vulnerability, published May 19, 2025. Fixed in node 20.19.2.
- Severity
- 3.7 LowCVSS 3.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
20.19.2node +1 more
Description
This CVE record has been withdrawn due to a duplicate entry CVE-2025-23165.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected products
Affected packages
What each source reports
GitHub Advisories Score usedGHSA-7q3w-f4rc-vr9m
In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in ...
In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.
Impact:
- This vulnerability affects APIs relying on
ReadFileUtf8on Node.js release lines: v20 and v22.
- Record
GHSA-7q3w-f4rc-vr9m- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-401
- Updated
- 2026-11-02
CVE ListNo score
This CVE record has been withdrawn due to a duplicate entry CVE-2025-23165.
- Record
CVE-2025-23122- Updated
- 2026-11-02
EUVDEUVD-2025-15710
This CVE record has been withdrawn due to a duplicate entry CVE-2025-23165.
- Record
EUVD-2025-15710- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
NVDNo score
Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23165.
- Record
CVE-2025-23122- Updated
- 2026-11-02
OSVBIT-node-2025-23122No score
Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23165.
- Record
BIT-node-2025-23122- Updated
- 2026-11-02
OSVBIT-node-min-2025-23122No score
Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23165.
- Record
BIT-node-min-2025-23122- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.