CVE-2025-23085

Summary

CVE-2025-23085 is a memory leak vulnerability in Node.js HTTP/2 Server affecting versions 18.x, 20.x, 22.x, and 23.x. When a remote peer abruptly ends a socket connection without sending a GOAWAY notification or if an invalid header causes the connection termination, the nghttp2 library fails to properly handle the situation, leading to increased memory consumption. This memory leak could potentially result in denial of service under heavy traffic conditions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.