diff --git a/src/client/src/tscUtil.c b/src/client/src/tscUtil.c
index 1073eec6ea7de122d311620f058abfcf97f09bdb..dbd3f464eaf457b9002bb5cd6af6bfd88e5cfbc1 100644
--- a/src/client/src/tscUtil.c
+++ b/src/client/src/tscUtil.c
@@ -87,6 +87,7 @@ void tscGetMetricMetaCacheKey(SQueryInfo* pQueryInfo, char* str, uint64_t uid) {
     MD5Update(&ctx, (uint8_t*)tmp, keyLen);
     char* pStr = base64_encode(ctx.digest, tListLen(ctx.digest));
     strcpy(str, pStr);
+    free(pStr);
   }
 
   free(tmp);
diff --git a/src/modules/http/src/httpAuth.c b/src/modules/http/src/httpAuth.c
index 4503accc0acdc74f1035b91bb2b85a344eb143fe..1ba11aba09789433b476c34864906fa13891dafc 100644
--- a/src/modules/http/src/httpAuth.c
+++ b/src/modules/http/src/httpAuth.c
@@ -75,6 +75,8 @@ bool httpParseTaosdAuthToken(HttpContext *pContext, char *token, int len) {
   unsigned char *base64 = base64_decode(token, len, &outlen);
   if (base64 == NULL || outlen == 0) {
     httpError("context:%p, fd:%d, ip:%s, taosd token:%s parsed error", pContext, pContext->fd, pContext->ipstr, token);
+    if (base64)
+      free(base64);
     return false;
   }
   if (outlen != (TSDB_USER_LEN + TSDB_PASSWORD_LEN)) {