Node.js Memory Leak Vulnerability in HTTP/2 Server

A memory leak vulnerability has been identified in Node.js versions 18.x, 20.x, 22.x, and 23.x, specifically within the HTTP/2 Server implementation. The issue arises when a remote peer abruptly closes the socket without sending a GOAWAY notification, or when an invalid header is detected by nghttp2, leading to connection termination. This flaw can cause increased memory consumption and potentially result in a denial-of-service condition under certain circumstances.

Impact

Exploitation of this vulnerability can lead to a memory leak outside the heap, causing increased memory usage and potential denial-of-service conditions.

Remediation

Users can upgrade to Node.js versions 18.20.6, 20.18.2, 22.13.1, or 23.6.1 to address this vulnerability.