FortiOS 7.4 and 7.6: the GUI daemon that eats the firewall (bug 1227167)

Call: Known issue. The node daemon, which runs the FortiOS web GUI, leaks memory until the FortiGate drops into conserve mode. Fortinet tracks it as bug 1227167. It sits in the builds that fix CVE-2025-61624, which is being exploited in the wild, so going backwards is not an option. Go forward to 7.4.13, and turn on the auto-restart workaround wherever you can’t upgrade yet.

Update, Oct 26: 7.6.8 breaks admin SAML SSO. Fortinet confirms that after upgrading to 7.6.8, administrator SSO fails with “Single Sign-On Failed”. It’s in the 7.6.8 release notes as known issue 1338764, and in a Fortinet support article.

Affected: admin FortiCloud SSO, admin SAML with a third-party IdP such as Entra ID, and Security Fabric SSO to downstream FortiGates.
Not affected: VPN user SSO, local admins, RADIUS, LDAP and TACACS+ admins, and FortiOS 7.2.14, 7.4.13, 7.6.7 and 8.0.2.
Fix: Fortinet schedules it for 7.6.9 and gives no date.
Workaround: use another admin authentication method. If you have none, you’ll need console access or FortiManager to recover.
How to confirm it: log in as a local admin and look for a “FORTISM Violation” in diagnose debug crashlog read.
What to do on 7.6: staying on 7.6.7 isn’t an answer. Fortinet’s Oct 22 hardening release fixes critical and high-severity bugs in everything below 7.6.8. Before upgrading, create a local or RADIUS/LDAP/TACACS+ admin and test it, with trusted hosts and MFA, then upgrade.

Two more 7.6.8 known issues are worth a look before you upgrade:

Hardware-specific: the 1800F/1801F drops traffic on SFP ports (1353422), and interfaces stay down on the 370xF and 480xF (1353040).
All the hardening builds, including 7.4.13: with deep inspection on, websites on non-standard HTTPS ports such as 8443 return ERR_EMPTY_RESPONSE (1353958).

Affected: Fortinet lists 1227167 under Known Issues for FortiOS 7.4.9, 7.4.10, 7.4.11, 7.4.12 and 7.6.6. Users report the same leak on 7.6.7, although the 7.6.7 release notes don’t list it. Fortinet’s own article scopes it to “FortiOS v7.4.x and v7.6.x”.

Fixed in: 7.4.13 (build 2933, Oct 22) and 8.0.1 both list 1227167 as resolved. On 7.6, Fortinet’s article says the fix is expected in 7.6.8 (build 3744, Oct 22). The 7.6.8 resolved list doesn’t name 1227167, but it does include two V8 JavaScript engine memory fixes, 1212624 and 1225806, and 1227167 is no longer among its known issues. Until 7.6.8 is shown to hold, treat it as probably fixed, not confirmed.

What breaks:

node memory climbs over days or weeks. One 80F on 7.4.11 went from 85 MB to 230 MB in three days, and Fortinet’s example shows 603 MB.
The unit crosses the 88% red threshold and enters conserve mode.
Users report the GUI going unreachable. Separately, a 50G HA pair on 7.6.7 kept dropping into conserve mode and losing routing until it failed over or rebooted, though that thread never pinned it on a specific daemon.

Who’s hit: Mostly small-memory boxes (40F, 60F, 80F, 50G) on the builds above, since 2 GB and 4 GB of RAM leaves little headroom. An older Fortinet article names Security Fabric and FortiManager polling as things that make node work harder.

Watch the CVE math: CVE-2025-61624 is fixed in 7.4.10+ and 7.6.5+. That means 7.4.10 through 7.4.12 and 7.6.6 are patched for the exploited bug and leak anyway. Rolling back to 7.4.9 trades the leak for an exploited vulnerability, and 7.4.9 leaks too. Only 7.4.13 is confirmed clean on both counts.

Workaround:

Check whether you’re hit. Run diagnose sys top-mem 5 and get system performance status | grep Mem a few times over several hours. If node keeps growing, you’re hit.
Turn on Fortinet’s workaround, which restarts node when it crosses a memory threshold:

config system global
    set web-svc-auto-restart enable
end

To clear it by hand, run diagnose nodejs process restart.
Before upgrading from 7.4.11 or 7.6.6, turn web-svc-auto-restart off and turn it back on afterwards. Leaving it on during the upgrade to 7.4.12 or 7.6.7 wipes some config system global settings (hostname, timezone, admin-scp, VDOM mode). That’s bug 1277454, fixed in 7.4.13 and 7.6.8.

FortiOS 7.4 and 7.6: the GUI daemon that eats the firewall (bug 1227167)

Sources

More from October 2026 patch cycle