Node.js Memory Leak Vulnerability in ReadFileUtf8 Binding

A memory leak vulnerability has been identified in Node.js versions 20.x and 22.x, specifically within the internal binding of ReadFileUtf8. The issue arises from a corrupted pointer in the uv_fs_s.file structure, where a UTF-16 path buffer is improperly managed. This misallocation leads to an unrecoverable memory leak with each function call. Over time, the repeated invocation of this API can cause unbounded memory growth, ultimately resulting in a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a memory leak that accumulates with each call to the ReadFileUtf8 API, leading to unbounded memory growth and a denial-of-service condition.

Remediation

Users can upgrade to Node.js versions 20.19.2 or 22.15.1 to address this vulnerability.