PT-2025-4815 · Nghttp2+10 · Nghttp2+10
Newtmitch
·
Published
2025-01-21
·
Updated
2025-12-08
·
CVE-2025-23085
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Node.js versions 18.x through 23.x
Description
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.
Recommendations
For Node.js versions 18.x, 20.x, 22.x, and 23.x, consider implementing a workaround to handle abrupt socket closures and invalid headers to prevent memory leaks.
As a temporary workaround, consider disabling the use of HTTP/2 until a patch is available.
Restrict access to the nghttp2 module to minimize the risk of exploitation.
Avoid using the
nghttp2 library in the affected API endpoints until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Node.Js
Red Hat
Red Os
Rocky Linux
Suse
Nghttp2