CVE-2025-23085

EUVD-2025-3113

07.02.2025, 07:15

A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.

This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
hackerone	CNA	5.3 MEDIUM				CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 36%

Debian Releases

Debian Product

Codename

nodejs

bookworm	postponed
bookworm (security)	vulnerable
bullseye	vulnerable
bullseye (security)	12.22.12~dfsg-1~deb11u7 fixed
forky	22.22.0+dfsg+~cs22.19.6-1 fixed
sid	22.22.0+dfsg+~cs22.19.13-2 fixed
trixie	20.19.2+dfsg-1 fixed

Common Weakness Enumeration

CWE-401 - Missing Release of Memory after Effective Lifetime
The software does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References

https://nodejs.org/en/blog/vulnerability/january-2025-security-releases

https://lists.debian.org/debian-lts-announce/2025/02/msg00031.html

https://security.netapp.com/advisory/ntap-20250321-0003/