CVE-2025-59464

A memory leak in Node.js’s OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. When applications call socket.getPeerCertificate(true), each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.

A memory leak in Node.js’s OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. When applications call socket.getPeerCertificate(true), each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.

A memory leak in Node.js’s OpenSSL integration occurs when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. When applications call socket.getPeerCertificate(true), each certificate field leaks memory, allowing remote clients to trigger steady memory growth through repeated TLS connections. Over time this can lead to resource exhaustion and denial of service.

These are all security issues fixed in the corepack24-24.13.0-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs24 fixes the following issues:

Update to version 24.14.1.

Security issues fixed:

• CVE-2026-21717: trivially predictable hash collisions due to flaw in V8's string hashing mechanism allows for performance degradation via a crafted request (bsc#1260494).
• CVE-2026-21716: incomplete fix for CVE-2024-36137 allows promise-based FileHandle methods to be used to modify file permissions and ownership on already-open file descriptors (bsc#1260462).
• CVE-2026-21715: flaw in the Permission Model filesystem enforcement allows for file existence disclosure and filesystem path enumeration via fs.realpathSync.native() (bsc#1260482).
• CVE-2026-21714: memory leak in Node.js HTTP/2 server allows for resource exhaustion via WINDOW_UPDATE frames sent on stream 0 (bsc#1260480).
• CVE-2026-21713: timing side-channel due to flaw in Node.js HMAC verification allows for discovery of HMAC values and potential MAC forgery (bsc#1260463).
• CVE-2026-21712: assertion error caused by flaw in URL processing allows for a process crash via a URL with a malformed IDN (bsc#1260460).
• CVE-2026-21710: uncaught TypeError when handling HTTP requests allows for a process crash via requests with a header named __proto__ when the application accesses req.headersDistinct (bsc#1260455).
• CVE-2026-21637: flaw in TLS error handling allows for resource exhaustion and crash when pskCallback or ALPNCallback are in use (bsc#1256576).
• CVE-2025-59464: memory leak allows for remote denial of service against applications processing TLS client certificates (bsc#1256572).

Other updates and bugfixes:

• Version 24.14.0:
  • async_hooks: add trackPromises option to createHook()
  • build,deps: replace cjs-module-lexer with merve
  • deps: add LIEF as a dependency
  • events: repurpose events.listenerCount() to accept EventTargets
  • fs: add ignore option to fs.watch
  • http: add http.setGlobalProxyFromEnv()
  • module: allow subpath imports that start with #/
  • process: preserve AsyncLocalStorage in queueMicrotask only when needed
  • sea: split sea binary manipulation code
  • sqlite: enable defensive mode by default
  • sqlite: add sqlite prepare options args
  • src: add initial support for ESM in embedder API
  • stream: add bytes() method to node:stream/consumers
  • stream: do not pass readable.compose() output via Readable.from()
  • test: use fixture directories for sea tests
  • test_runner: add env option to run function
  • test_runner: support expecting a test-case to fail
  • util: add convertProcessSignalToExitCode utility
  • For details, see https://nodejs.org/en/blog/release/v24.14.0

This update for nodejs24 fixes the following issues:

• Update to 24.14.1
• CVE-2026-21637: synchronous exceptions thrown during certain callbacks bypass the standard TLS error handling paths and can cause a denial of service (bsc#1256576).
• CVE-2026-21710: uncaught TypeError exception can cause a denial of service (bsc#1260455).
• CVE-2026-21712: malformed URL format can lead to a crash (bsc#1260460).
• CVE-2026-21713: timing side-channel in HMAC verification via memcmp can lead to potential MAC forgery (bsc#1260463).
• CVE-2026-21714: WINDOW_UPDATE frames on stream 0 can lead to memory leak (bsc#1260480).
• CVE-2026-21715: permission model bypass in realpathSync.native can allow file existence disclosure (bsc#1260482).
• CVE-2026-21716: promise-based FileHandle methods can be used to modify file permissions and ownership (bsc#1260462).
• CVE-2026-21717: crafted request can lead to trivially predictable hash collisions (bsc#1260494).

This update for nodejs24 fixes the following issues:

Update to version 24.14.1.

Security issues fixed:

• CVE-2026-21717: trivially predictable hash collisions due to flaw in V8's string hashing mechanism allows for performance degradation via a crafted request (bsc#1260494).
• CVE-2026-21716: incomplete fix for CVE-2024-36137 allows promise-based FileHandle methods to be used to modify file permissions and ownership on already-open file descriptors (bsc#1260462).
• CVE-2026-21715: flaw in the Permission Model filesystem enforcement allows for file existence disclosure and filesystem path enumeration via fs.realpathSync.native() (bsc#1260482).
• CVE-2026-21714: memory leak in Node.js HTTP/2 server allows for resource exhaustion via WINDOW_UPDATE frames sent on stream 0 (bsc#1260480).
• CVE-2026-21713: timing side-channel due to flaw in Node.js HMAC verification allows for discovery of HMAC values and potential MAC forgery (bsc#1260463).
• CVE-2026-21712: assertion error caused by flaw in URL processing allows for a process crash via a URL with a malformed IDN (bsc#1260460).
• CVE-2026-21710: uncaught TypeError when handling HTTP requests allows for a process crash via requests with a header named __proto__ when the application accesses req.headersDistinct (bsc#1260455).
• CVE-2026-21637: flaw in TLS error handling allows for resource exhaustion and crash when pskCallback or ALPNCallback are in use (bsc#1256576).
• CVE-2025-59464: memory leak allows for remote denial of service against applications processing TLS client certificates (bsc#1256572).

Other updates and bugfixes:

• Version 24.14.0:
  • async_hooks: add trackPromises option to createHook()
  • build,deps: replace cjs-module-lexer with merve
  • deps: add LIEF as a dependency
  • events: repurpose events.listenerCount() to accept EventTargets
  • fs: add ignore option to fs.watch
  • http: add http.setGlobalProxyFromEnv()
  • module: allow subpath imports that start with #/
  • process: preserve AsyncLocalStorage in queueMicrotask only when needed
  • sea: split sea binary manipulation code
  • sqlite: enable defensive mode by default
  • sqlite: add sqlite prepare options args
  • src: add initial support for ESM in embedder API
  • stream: add bytes() method to node:stream/consumers
  • stream: do not pass readable.compose() output via Readable.from()
  • test: use fixture directories for sea tests
  • test_runner: add env option to run function
  • test_runner: support expecting a test-case to fail
  • util: add convertProcessSignalToExitCode utility
  • For details, see https://nodejs.org/en/blog/release/v24.14.0