Node.js OpenSSL Integration Memory Leak Vulnerability Leading to Denial-of-Service

A memory leak vulnerability has been identified in Node.js's integration with OpenSSL. This issue arises when X.509 certificate fields are converted to UTF-8 without properly freeing the allocated memory. As a result, applications that process TLS client certificates can experience a gradual increase in memory usage, triggered by remote clients through repeated TLS connections. Over time, this memory leak can cause resource exhaustion, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a memory leak that can be exploited remotely, leading to resource exhaustion and denial-of-service.

Remediation

This vulnerability has been fixed in Node.js version 24.12.0. Users should upgrade to this version or a later release in the 24.x line.