Memory Leak Vulnerability in Node.js Package - CVE-2025-23085
Summary
ALPINE-CVE-2025-23085: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Affects nodejs versions < 22.13.1-r0. Fixed in 22.13.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The Node.js package for Alpine Linux provides a lightweight version of Node.js optimized for Alpine's musl libc. This package is crucial for developers who require a minimal footprint for their applications while leveraging Node.js capabilities. However, it is susceptible to vulnerabilities that can affect performance and stability.
Vulnerability Detail
A memory leak vulnerability has been identified in Node.js versions 18.x, 20.x, 22.x, and 23.x, specifically affecting HTTP/2 Server users. The issue arises when a remote peer abruptly closes the socket without sending a GOAWAY notification, or when an invalid header is detected by nghttp2, leading to connection termination. This flaw can result in increased memory consumption and potential denial of service under certain conditions, posing a significant risk to applications relying on HTTP/2 functionality.
How To Fix
Minimum fixed version
22.13.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing connection handling logic that gracefully manages abrupt socket closures and validates headers before processing them. This can help mitigate the impact of the memory leak until the package is updated.
Conclusion
The memory leak vulnerability CVE-2025-23085 poses a significant risk to applications using Node.js versions 18.x, 20.x, 22.x, and 23.x. It is crucial for developers to update their Node.js packages to the patched version 22.13.1-r0 or later to mitigate the risk of increased memory consumption and potential denial of service. Utilizing tools like Vulert can further enhance security by providing real-time vulnerability alerts.
See every vulnerability recorded for nodejs →
FAQ
CVE-2025-23085 is a memory leak vulnerability in Node.js affecting HTTP/2 Server users, which can lead to increased memory consumption and potential denial of service.
The affected versions include Node.js v18.x, v20.x, v22.x, and v23.x.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update the Node.js package to version 22.13.1-r0 or later using the command 'apk add --update nodejs=22.13.1-r0'.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json, helping developers maintain secure applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
