CVE intelligence

CVE-2025-23085

Vulnerability intelligence

Published Feb 7, 2025Sources checked Oct 3, 2026

5.3MEDIUMCVSS out of 10

What this means

Review the available evidence

CVE-2025-23085 and is rated Medium severity with a CVSS score of 5.3. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

CBL-Mariner Releases

Vendor-listed releases

20.14.0-5
18.20.3-3

CISA KEVNot listedBased on the latest collected catalog

EPSS1.4%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2025-23085?

A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.