Memory Leak in HTTP/2 Server on Node.js Affects Multiple Versions

CVE-2025-23085

What is CVE-2025-23085?

A memory leak may occur in the HTTP/2 Server component of Node.js when a remote peer unexpectedly closes a socket without issuing a GOAWAY notification. This issue can also be triggered if an invalid header is detected by nghttp2, resulting in connection termination. These scenarios could contribute to increased memory usage, ultimately leading to potential denial of service under certain operational conditions, thereby impacting application performance.

References