A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
CVSS Details
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejsUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade nodejs-devel | Feb 20, 2025 | Feb 7, 2025 |
| Alpine Linux | — | Upgrade nodejs | Aug 8, 2025 | Feb 7, 2025 |
| Amazon_linux_2023 | — | Upgrade nodejs20-debuginfoUpgrade nodejs-docsUpgrade nodejs-npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs20-develUpgrade nodejs20-libsUpgrade nodejs20Upgrade nodejs20-npmUpgrade nodejs20-libs-debuginfoUpgrade v8-11.3-develUpgrade nodejs20-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejsUpgrade v8-10.2-develUpgrade nodejs-develUpgrade nodejs20-full-i18nUpgrade nodejs-full-i18nUpgrade nodejs20-docs | Feb 17, 2025 | Jan 21, 2025 |
| Debian | — | Upgrade nodejs | Feb 26, 2025 | Feb 7, 2025 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Jun 13, 2025 | Feb 7, 2025 |
| Oracle_linux | — | Upgrade nodejs-libsUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade v8-12.4-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade npm | Feb 14, 2025 | Jan 21, 2025 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade npmUpgrade v8-12.4-develUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-full-i18n | Feb 13, 2025 | Feb 7, 2025 |
| Rocky_linux | — | Upgrade v8-12.4-develUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-devel | Feb 14, 2025 | Feb 7, 2025 |
| Suse | — | Upgrade nodejs22-develUpgrade npm20Upgrade nodejs20-develUpgrade npm18Upgrade nodejs20Upgrade nodejs18-develUpgrade nodejs22-docsUpgrade npm22Upgrade nodejs18-docsUpgrade nodejs22Upgrade corepack22Upgrade nodejs20-docsUpgrade nodejs18Upgrade corepack20 | Jan 27, 2025 | Jan 24, 2025 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 7, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Feb 7, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub