CVE-2025-23085: Node.js HTTP/2 Server DoS Vulnerability

CVE-2025-23085 Overview

CVE-2025-23085 is a memory leak vulnerability affecting Node.js HTTP/2 server implementations. The flaw occurs when a remote peer abruptly closes the socket without sending a proper GOAWAY notification, or when an invalid header is detected by nghttp2, causing the connection to be terminated. This vulnerability can lead to increased memory consumption and potential denial of service conditions on affected Node.js servers.

Critical Impact

Attackers can exploit this memory leak to gradually exhaust server memory resources, potentially causing denial of service on Node.js HTTP/2 servers without requiring authentication.

Affected Products

• Node.js v18.x (HTTP/2 Server)
• Node.js v20.x (HTTP/2 Server)
• Node.js v22.x (HTTP/2 Server)
• Node.js v23.x (HTTP/2 Server)

Discovery Timeline

• 2025-02-07 - CVE-2025-23085 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-23085

Vulnerability Analysis

This memory leak vulnerability (CWE-401: Missing Release of Memory after Effective Lifetime) affects the HTTP/2 implementation in Node.js. When handling HTTP/2 connections, the server fails to properly release allocated memory under two specific conditions: when a remote peer closes the socket abruptly without sending a GOAWAY frame, or when nghttp2 detects an invalid header that causes connection termination.

The HTTP/2 protocol relies on the GOAWAY frame to gracefully signal the termination of a connection. When this notification is absent due to an abrupt disconnection, the cleanup routines that would normally free associated memory resources are not properly triggered. Similarly, when nghttp2 encounters malformed headers and terminates the connection, the same memory cleanup path is bypassed.

Root Cause

The root cause is improper memory management in the HTTP/2 connection handling code. Specifically, the implementation fails to release allocated memory buffers when connections are terminated unexpectedly. The nghttp2 library integration does not account for all edge cases where memory should be deallocated, particularly during error conditions and abrupt connection closures.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can repeatedly establish HTTP/2 connections to a vulnerable Node.js server and then abruptly terminate those connections without sending proper GOAWAY notifications. Alternatively, an attacker can send requests with deliberately malformed headers to trigger the nghttp2 error path.

By repeatedly triggering either condition, an attacker can cause progressive memory exhaustion on the target server. Over time, this can degrade server performance and eventually lead to denial of service as the system runs out of available memory.

Detection Methods for CVE-2025-23085

Indicators of Compromise

• Unusual memory growth patterns on Node.js HTTP/2 servers without corresponding increases in legitimate traffic
• High volume of incomplete HTTP/2 connection attempts from specific source IPs
• Elevated rates of HTTP/2 connection resets without proper GOAWAY frames in network captures
• Increased occurrence of nghttp2 header validation errors in application logs

Detection Strategies

• Monitor Node.js process memory usage for steady increases that do not correlate with legitimate workload patterns
• Implement connection rate limiting and track sources with abnormally high connection establishment rates
• Enable detailed HTTP/2 session logging to capture connection termination events and identify missing GOAWAY notifications
• Deploy network intrusion detection rules to identify patterns of malformed HTTP/2 headers

Monitoring Recommendations

• Set up memory threshold alerts for Node.js processes running HTTP/2 servers
• Implement application performance monitoring (APM) to track memory allocation patterns over time
• Configure log aggregation to correlate connection termination events across multiple server instances
• Establish baseline memory usage metrics to identify anomalous consumption patterns

How to Mitigate CVE-2025-23085

Immediate Actions Required

• Upgrade Node.js to the latest patched version addressing this vulnerability
• Implement connection rate limiting at the load balancer or reverse proxy level to reduce exposure
• Configure memory limits for Node.js processes to prevent complete resource exhaustion
• Consider temporarily disabling HTTP/2 if not operationally required until patching is complete

Patch Information

Node.js has released security updates addressing this vulnerability in the January 2025 security releases. Administrators should consult the Node.js January 2025 Security Releases for specific patched versions and upgrade instructions. Additional security advisories are available from Debian LTS and NetApp.

Workarounds

• Deploy a reverse proxy (such as nginx or HAProxy) in front of Node.js servers to handle HTTP/2 termination
• Implement aggressive connection timeout policies to limit the window for memory accumulation
• Configure process managers to automatically restart Node.js processes when memory thresholds are exceeded
• Use HTTP/1.1 instead of HTTP/2 until patches can be applied to eliminate the vulnerable code path

# Example: Configure Node.js memory limit and monitoring
# Set maximum heap size to limit memory consumption
NODE_OPTIONS="--max-old-space-size=2048" node server.js

# Enable HTTP/2 session debugging for monitoring
NODE_DEBUG=http2 node server.js