Fluid Attacks Database

Description

A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions.

This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	nodejs	=12.21.0~dfsg-5 \|\| =12.22.10~dfsg-1 \|\| =12.22.10~dfsg-2 \|\| =12.22.12~dfsg-1~deb11u1 \|\| =12.22.12~dfsg-1~deb11u2 \|\| =12.22.12~dfsg-1~deb11u3 \|\| =12.22.12~dfsg-1~deb11u4 \|\| =12.22.12~dfsg-1~deb11u5 \|\| =12.22.4~dfsg-1 \|\| =12.22.5~dfsg-1 \|\| =12.22.5~dfsg-2 \|\| =12.22.5~dfsg-2~11u1 \|\| =12.22.5~dfsg-3 \|\| =12.22.5~dfsg-4 \|\| =12.22.5~dfsg-5 \|\| =12.22.5~dfsg-6 \|\| =12.22.5~dfsg-7 \|\| =12.22.7~dfsg-1 \|\| =12.22.7~dfsg-2 \|\| =12.22.9~dfsg-1 \|\| >=0 <12.22.12~dfsg-1~deb11u6	12.22.12~dfsg-1~deb11u6
debian 12	nodejs	=18.13.0+dfsg1-1 \|\| =18.13.0+dfsg1-1.1 \|\| =18.19.0+dfsg-1 \|\| =18.19.0+dfsg-2 \|\| =18.19.0+dfsg-3 \|\| =18.19.0+dfsg-4 \|\| =18.19.0+dfsg-5 \|\| =18.19.0+dfsg-6 \|\| =18.19.0+dfsg-6~deb12u1 \|\| =18.19.0+dfsg-6~deb12u2 \|\| =18.19.1+dfsg-1 \|\| =18.19.1+dfsg-2 \|\| =18.19.1+dfsg-3 \|\| =18.19.1+dfsg-3.1 \|\| =18.19.1+dfsg-4 \|\| =18.19.1+dfsg-6 \|\| =18.20.1+dfsg-1 \|\| =18.20.1+dfsg-2 \|\| =18.20.1+dfsg-3 \|\| =18.20.1+dfsg-4 \|\| =18.20.4+dfsg-1~deb12u1 \|\| >=0 <18.20.4+dfsg-1~deb12u2	18.20.4+dfsg-1~deb12u2
alpine v3.21	nodejs	>=0 <22.13.1-r0	22.13.1-r0
alpine v3.22	nodejs	>=0 <22.13.1-r0	22.13.1-r0
debian 13	nodejs	=20.19.2+dfsg-1 \|\| >=0 <20.19.2+dfsg-1+deb13u1	20.19.2+dfsg-1+deb13u1
debian 14	nodejs	>=0 <20.18.2+dfsg-1	20.18.2+dfsg-1
alpine v3.23	nodejs	>=0 <22.13.1-r0	22.13.1-r0
rpm rhel8	nodejs	<1:18.20.6-1.module+el8.10.0+22776+24cd6c55	1:18.20.6-1.module+el8.10.0+22776+24cd6c55
rpm rhel9	nodejs	<1:18.20.6-1.module+el9.5.0+22773+9a359385	1:18.20.6-1.module+el9.5.0+22773+9a359385
rpm rhel10	nodejs22	-	-

1-10 of 11

Aliases

1. CVE-2025-230852. NVD-2025-230853. OSV-DEBIAN-2025-230854. OSV-2025-230855. OSV-ALPINE-2025-230856. SECURITY-TRACKER-CVE-2025-230857. SECURITY-CVE-2025-23085

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.