5.3
Medium
CVE-2025-23085 A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification
Description
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 23.0 | 23.0 → < 23.6.1 | 23.6.1 |
| Node 22.0 | 22.0 → < 22.13.1 | 22.13.1 |
| Node 21.0 | 21.0 → latest | No fix stated |
| Node 20.0 | 20.0 → < 20.18.2 | 20.18.2 |
| Node 19.0 | 19.0 → latest | No fix stated |
| Node 18.0 | 18.0 → < 18.20.6 | 18.20.6 |
| Node 17.0 | 17.0 → latest | No fix stated |
| Node 16.0 | 16.0 → latest | No fix stated |
| Node 15.0 | 15.0 → latest | No fix stated |
Show the 11 other branches Hide the 11 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Node 14.0 | 14.0 → latest | No fix stated |
| Node 13.0 | 13.0 → latest | No fix stated |
| Node 12.0 | 12.0 → latest | No fix stated |
| Node 11.0 | 11.0 → latest | No fix stated |
| Node 10.0 | 10.0 → latest | No fix stated |
| Node 9.0 | 9.0 → latest | No fix stated |
| Node 8.0 | 8.0 → latest | No fix stated |
| Node 7.0 | 7.0 → latest | No fix stated |
| Node 6.0 | 6.0 → latest | No fix stated |
| Node 5.0 | 5.0 → latest | No fix stated |
| Node 4.0 | 4.0 → latest | No fix stated |
References
- nodejs.org nodejs.org
Timeline
- Published
- Last modified
Other CVEs of Node
The 129 CVEs of Node →
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard…
3.6
Low
CVE-2026-106074
A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,…
4.8
Medium
CVE-2026-106070
A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after…
3.7
Low
CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read…
3.3
Low