A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

🗓️ 14 Feb 2025 08:00:00Reported by MicrosoftType

CVE-2025-23085 vulnerability affecting Microsoft products.

Reporter	Title	Published	Views	Family All 208
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Data Synchronization app for IBM QRadar SIEM includes components with known vulnerabilities	15 Aug 202514:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	26 Mar 202518:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in nodejs affect IBM Business Automation Workflow Configuration Editor (nodejs January security release)	12 Mar 202518:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js (CVE-2025-23085, CVE-2025-23084 & CVE-2025-22150)	27 Feb 202516:08	–	ibm
Tenable Nessus	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2025-822)	5 Feb 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2025-843)	26 Feb 202500:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0029: nodejs:20 (ALINUX3-SA-2025:0029)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : nodejs:20 (ALSA-2025:1351)	17 Feb 202500:00	–	nessus
Tenable Nessus	AlmaLinux 9 : nodejs:20 (ALSA-2025:1443)	17 Feb 202500:00	–	nessus