node.js-22.15.1

[Bruce Dubbs]

New point version.

[Douglas R. Reno]

Release notes:

Notable Changes

• (CVE-2025-23166) fix error handling on async crypto operation
• (CVE-2025-23165) add missing call to uv_fs_req_cleanup

Commits

• [edaf54da00] - fs: added test for missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [9f403e98ef] - (CVE-2025-23165) fs: add missing call to uv_fs_req_cleanup (Justin Nietzel) #57811
• [f4494d38f1] - (CVE-2025-23166) src: fix error handling on async crypto operations (RafaelGSS) nodejs-private/node-private#709

CVE Information:

• CVE-2025-23166 (High)

Improper error handling in async cryptographic operations crashes process (CVE-2025-23166) - (high)

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

• CVE-2025-23165 (Low)

Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string. (CVE-2025-23165) - (low)

In Node.js, the ReadFileUtf8 internal binding leaks memory due to a corrupted pointer in uv_fs_s.file: a UTF-16 path buffer is allocated but subsequently overwritten when the file descriptor is set. This results in an unrecoverable memory leak on every call. Repeated use can cause unbounded memory growth, leading to a denial of service.

[Douglas R. Reno]

Zeckma contacted me on Discord about this one, going to reassign it to her

[zeckma]

Fixed at feed3f264365c21fa9ff0d429d7756c696d8a9fa. Thanks for reassigning the ticket to me, Doug! Good luck with the SAs!