CVE-2025-23085

What it actually does

A memory leak occurs in the HTTP/2 server implementation when a remote peer closes the socket abruptly without sending a GOAWAY frame or when nghttp2 detects an invalid header that terminates the connection, causing gradual accumulation of unreleased memory.

Why it matters to the business

HTTP/2 servers may consume increasing amounts of memory over time, potentially leading to resource exhaustion, degraded performance, or service outages under sustained connection handling conditions; urgency is low given no KEV listing or active exploitation reports.

How an attack unfolds

An attacker repeatedly opens HTTP/2 connections to a vulnerable Node.js server and either closes them abruptly without a GOAWAY notification or supplies invalid headers that force connection termination by the peer, triggering the leak each time until memory pressure causes denial of service.

How to fix it

Upgrade Node.js v18.x, v20.x, v22.x and v23.x to the latest patched releases that address the nghttp2 memory leak. For Red Hat Enterprise Linux 8 baseos and crb repositories, update the listed pcre packages to the fixed version 0:8.42-6.el8.

How to confirm the fix worked

Confirm Node.js and nghttp2 versions are updated beyond the affected releases; monitor process memory usage under simulated abrupt connection closures to verify no leak occurs; check package managers show pcre and related packages at 0:8.42-6.el8 or newer on RHEL 8 systems.

Typical attack path

1. Establish multiple HTTP/2 connections to the target server
2. Abruptly close sockets without sending GOAWAY frames or inject invalid headers
3. Repeat connection attempts at scale to amplify the leak
4. Observe server memory growth leading to slowdown or crash

How to detect it

Review Node.js process memory metrics and logs for repeated abrupt HTTP/2 connection terminations or invalid header events; correlate with nghttp2 error messages indicating connection resets without GOAWAY.

What your security team should do

• Prioritize patching Node.js HTTP/2 servers in internet-facing or high-traffic environments
• Apply the exact fixed package versions 0:8.42-6.el8 for all listed pcre components on RHEL 8
• Implement connection rate limiting and monitoring for memory consumption anomalies
• Review downstream dependents and plan upgrades given ecosystem prevalence of Node.js