Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-23085

A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing t

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

NodeJS Node

Default version status: unaffected

  • 4.0 to < 4.*affected
  • 5.0 to < 5.*affected
  • 6.0 to < 6.*affected
  • 7.0 to < 7.*affected
  • 8.0 to < 8.*affected
  • 9.0 to < 9.*affected
  • 10.0 to < 10.*affected
  • 11.0 to < 11.*affected
  • 12.0 to < 12.*affected
  • 13.0 to < 13.*affected
  • 14.0 to < 14.*affected
  • 15.0 to < 15.*affected
  • 16.0 to < 16.*affected
  • 17.0 to < 17.*affected
  • 18.0 to < 18.20.6affected
  • 19.0 to < 19.*affected
  • 20.0 to < 20.18.2affected
  • 21.0 to < 21.*affected
  • 22.0 to < 22.13.1affected
  • 23.0 to < 23.6.1affected

References