Missing Release of Memory after Effective Lifetime Affecting node package, versions [18.20.0,18.20.6)[20.18.1,20.18.2)[22.13.0,22.13.1)[23.6.0,23.6.1)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Missing Release of Memory after Effective Lifetime vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-UPSTREAM-NODE-8670156
- published29 Jan 2025
- disclosed21 Jan 2025
- creditnewtmitch
Introduced: 21 Jan 2025
NewCVE-2025-23085 (opens in a new tab)How to fix?
Upgrade node to version 18.20.6, 20.18.2, 22.13.1, 23.6.1 or higher.
Overview
node is a JavaScript runtime built on Chrome's V8 JavaScript engine.
Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime. An attacker could cause increased memory consumption and potential denial of service by abruptly closing the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak is triggered.