5.3

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-23085

CVE-2025-23085: A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY...

A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.

This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-23085

CVE-2025-23085:

5.3

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability describes a memory leak in Node.js's HTTP/2 server implementation under two conditions: 1) a remote peer abruptly closes the socket without sending a GOAWAY notification, and 2) an invalid header is detected by nghttp2, causing the peer to terminate the connection (often indicated by an ERR_PROTO from nghttp2).

The analysis of the provided commit (e.g., 6cc8d58e6f97c37c228f134bd9b98246c8871fb1, which is representative of the fix across versions) shows modifications primarily in lib/internal/http2/core.js and src/node_http2.cc.

onFrameError (in lib/internal/http2/core.js): This function is involved in handling errors that occur during HTTP/2 communication. The patch changes the session and stream closing logic from synchronous to asynchronous (setImmediate). This suggests that the previous synchronous cleanup in error paths (which could be triggered by abrupt peer disconnections or invalid frames) was insufficient or prone to race conditions, leading to leaks. Deferring the close operations allows the event loop to process other pending events (like the socket closure itself) before attempting to free resources, which is a common pattern to fix such leaks.
Http2Session::OnInvalidFrame (in src/node_http2.cc): This C++ function is a callback from the nghttp2 library when it detects an invalid incoming frame. The patch explicitly adds NGHTTP2_ERR_PROTO to the list of error codes considered severe enough to trigger error handling and session closure. This directly addresses the scenario where an invalid header leads to a protocol error and peer termination. If this specific error condition wasn't previously ensuring full cleanup of the Http2Session, it would cause a leak.

Both functions are critical in the error handling and session lifecycle management of HTTP/2 connections. The patches aim to make the cleanup process more robust in scenarios involving unexpected disconnections or protocol violations by the peer, which are the root causes of the described memory leak.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.