Memory Leak Vulnerability in Node.js HTTP/2 Server
Summary
CVE-2025-23085: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Affects nodejs versions < 22.13.1-r0. Fixed in 22.13.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The HTTP/2 Server module in Node.js enhances performance and efficiency for web applications by allowing multiplexing of requests. However, it is susceptible to a memory leak vulnerability when remote peers close sockets unexpectedly.
Vulnerability Detail
CVE-2025-23085 describes a memory leak that occurs when a remote peer abruptly closes the socket without sending a GOAWAY notification. This issue can also be triggered if nghttp2 detects an invalid header, leading to connection termination by the peer. The memory leak can result in increased memory consumption, potentially leading to denial of service under certain conditions. This vulnerability affects users of the HTTP/2 Server on Node.js versions 18.x, 20.x, 22.x, and 23.x.
How To Fix
Minimum fixed version
22.13.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement connection handling logic to gracefully manage socket closures and avoid abrupt terminations. This may involve adding checks for socket states and ensuring proper cleanup of resources.
Conclusion
CVE-2025-23085 is a significant vulnerability affecting the HTTP/2 Server in Node.js, leading to potential memory leaks and denial of service. It is crucial for users to update their Node.js installations to the patched versions to ensure the security and stability of their applications.
See every vulnerability recorded for nodejs →
FAQ
CVE-2025-23085 is a vulnerability in Node.js that can cause a memory leak when a remote peer closes a socket unexpectedly.
The vulnerability affects Node.js versions 18.x, 20.x, 22.x, and 23.x.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The memory leak can lead to increased memory consumption, which may result in a denial of service if not addressed.
Yes, a patch is available. Update to Node.js version 22.13.1-r0 or later to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
