]> dgit.raspbian.org Git - nodejs.git/commit
src: fix HTTP2 mem leak on premature close and ERR_PROTO
authorRafaelGSS <rafael.nunu@hotmail.com>
Tue, 17 Dec 2024 19:58:03 +0000 (16:58 -0300)
committerBastien Roucariès <rouca@debian.org>
Sun, 16 Aug 2026 17:34:06 +0000 (19:34 +0200)
commitadf22bacefabbcc33ba271267db9296824fc3ca6
tree0db31978ca6089df3a1efd10144ab61c9b097355
parente8ee4b4fa6a4abdca1e282f791341ae00cc21335
src: fix HTTP2 mem leak on premature close and ERR_PROTO

This commit fixes a memory leak when the socket is
suddenly closed by the peer (without GOAWAY notification)
and when invalid header (by nghttp2) is identified and the
connection is terminated by peer.

Refs: https://hackerone.com/reports/2841362
PR-URL: https://github.com/nodejs-private/node-private/pull/650
Reviewed-By: James M Snell <jasnell@gmail.com>
CVE-ID: CVE-2025-23085
origin: https://github.com/nodejs/node/commit/6cc8d58e6f97c37c228f134bd9b98246c8871fb1

Gbp-Pq: Name CVE-2025-23085.patch
lib/internal/http2/core.js
src/node_http2.cc
test/parallel/test-http2-connect-method-extended-cant-turn-off.js
test/parallel/test-http2-invalid-last-stream-id.js [new file with mode: 0644]
test/parallel/test-http2-options-max-headers-block-length.js
test/parallel/test-http2-options-max-headers-exceeds-nghttp2.js
test/parallel/test-http2-premature-close.js [new file with mode: 0644]