Unrated
CVE-2025-23085
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
Announced Group revision 1
Original source ↗CVE-2025-23085
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:CVE-2025-23085
- Related CVEs
- CVE-2025-23085
Source reference:
/id
Publisher severity
No explicit severity was provided.
- Event
- #25919 · Revision 1
- Added to Heist Feed
- Publisher date