diff --git a/cadc-vos-server/build.gradle b/cadc-vos-server/build.gradle
index e75abbfc..3557b196 100644
--- a/cadc-vos-server/build.gradle
+++ b/cadc-vos-server/build.gradle
@@ -16,7 +16,7 @@ sourceCompatibility = 1.8
 
 group = 'org.opencadc'
 
-version = '2.0.13'
+version = '2.0.14'
 
 description = 'OpenCADC VOSpace server'
 def git_url = 'https://github.com/opencadc/vos'
diff --git a/cadc-vos-server/src/main/java/org/opencadc/vospace/server/actions/GetNodeAction.java b/cadc-vos-server/src/main/java/org/opencadc/vospace/server/actions/GetNodeAction.java
index ca5f1df7..bae90c73 100644
--- a/cadc-vos-server/src/main/java/org/opencadc/vospace/server/actions/GetNodeAction.java
+++ b/cadc-vos-server/src/main/java/org/opencadc/vospace/server/actions/GetNodeAction.java
@@ -145,6 +145,7 @@ public void doAction() throws Exception {
         }
         log.debug("found: " + target + " as " + serverNode);
         
+        ResourceIterator<Node> resourceIter = null;
         if (serverNode instanceof ContainerNode) {
             ContainerNode node = (ContainerNode) serverNode;
 
@@ -192,7 +193,8 @@ public void doAction() throws Exception {
 
             // Check for read permission to list child nodes.
             Subject subject = AuthenticationUtil.getCurrentSubject();
-            if (voSpaceAuthorizer.hasSingleNodeReadPermission(node, subject)) {
+            if ((pageLimit == null || pageLimit > 0) 
+                    && voSpaceAuthorizer.hasSingleNodeReadPermission(node, subject)) {
                 long start = System.currentTimeMillis();
                 log.debug(String.format("get children of %s: start=[%s] limit=[%s] detail=%s", target.getPath(), startURI, pageLimit, detailLevel));
                 try {
@@ -202,6 +204,7 @@ public void doAction() throws Exception {
                     } else {
                         node.childIterator = ci;
                     }
+                    resourceIter = node.childIterator;
                 } catch (UnsupportedOperationException ex) {
                     throw NodeFault.OptionNotSupported.getStatus(ex.getMessage());
                 }
@@ -237,8 +240,18 @@ public void doAction() throws Exception {
 
         syncOutput.setCode(200);
         syncOutput.setHeader(HttpTransfer.CONTENT_TYPE, getMediaType());
-        // TODO: should the VOSURI in the output target or actual? eg resolveLinks=true
-        nodeWriter.write(localServiceURI.getURI(serverNode), serverNode, syncOutput.getOutputStream(), detail);
+        try {
+            nodeWriter.write(localServiceURI.getURI(serverNode), serverNode, syncOutput.getOutputStream(), detail);
+        } finally {
+            if (resourceIter != null) {
+                try {
+                    resourceIter.close();
+                } catch (Exception failToClose) {
+                    log.error("BADNESS: failed to close ContainerNode.childIterator -- possible resource leak", failToClose);
+                    
+                }
+            }
+        }
     }
     
     private class TagChildAccessRightsWrapper implements ResourceIterator<Node> {
diff --git a/cavern/VERSION b/cavern/VERSION
index 6dde57b4..2ee2a863 100644
--- a/cavern/VERSION
+++ b/cavern/VERSION
@@ -1,6 +1,6 @@
 ## deployable containers have a semantic and build tag
 # semantic version tag: major.minor
 # build version tag: timestamp
-VER=0.7.4
+VER=0.7.5
 TAGS="${VER} ${VER}-$(date -u +"%Y%m%dT%H%M%S")"
 unset VER
diff --git a/cavern/build.gradle b/cavern/build.gradle
index f6ea7cca..0059c849 100644
--- a/cavern/build.gradle
+++ b/cavern/build.gradle
@@ -43,7 +43,7 @@ dependencies {
     implementation 'org.opencadc:cadc-dali:[1.0,)'
     implementation 'org.opencadc:cadc-pkg-server:[1.2.3,)'
     implementation 'org.opencadc:cadc-vos:[2.0,)'
-    implementation 'org.opencadc:cadc-vos-server:[2.0.11,)'
+    implementation 'org.opencadc:cadc-vos-server:[2.0.14,)'
 
     runtimeOnly 'org.opencadc:cadc-access-control-identity:[1.2.0,)'
 
diff --git a/cavern/src/main/java/org/opencadc/cavern/nodes/FileSystemNodePersistence.java b/cavern/src/main/java/org/opencadc/cavern/nodes/FileSystemNodePersistence.java
index 70a4b29c..e67c22ad 100644
--- a/cavern/src/main/java/org/opencadc/cavern/nodes/FileSystemNodePersistence.java
+++ b/cavern/src/main/java/org/opencadc/cavern/nodes/FileSystemNodePersistence.java
@@ -345,7 +345,7 @@ public void close() throws IOException {
     private class IdentWrapper implements ResourceIterator<Node> {
 
         private final ContainerNode parent;
-        private final ResourceIterator<Node> childIter;
+        private ResourceIterator<Node> childIter;
         private final NodeUtil nut;
         
         IdentWrapper(ContainerNode parent, ResourceIterator<Node> childIter, NodeUtil nut) {
@@ -373,7 +373,11 @@ public Node next() {
 
         @Override
         public void close() throws IOException {
-            childIter.close();
+            if (childIter != null) {
+                // silently OK to close more than once
+                childIter.close();
+                childIter = null;
+            }
         }
     }