CVE-2025-23085: GOAWAY HTTP/2 frames cause memory leak outside heap
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.14.0-5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.3-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.6Fixed in 20.18.2Fixed in 22.13.1Fixed in 23.6.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.20.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.18.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.13.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 23.6.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2025-23085?
CVE-2025-23085 has been classified with a severity that could lead to increased resource consumption due to a memory leak.
How do I fix CVE-2025-23085?
To mitigate CVE-2025-23085, it is recommended to update Node.js to the latest version beyond the vulnerable releases.
Which versions of Node.js are affected by CVE-2025-23085?
CVE-2025-23085 affects Node.js versions from 18.x to 23.x.
What causes the memory leak in CVE-2025-23085?
The memory leak in CVE-2025-23085 is caused when a remote peer abruptly closes the socket without a GOAWAY notification or if invalid headers are detected.
Is there a workaround for CVE-2025-23085?
Currently, the best approach for CVE-2025-23085 is to apply the security updates as there are no effective workarounds identified.