UpHeron
All vulnerabilities

Servers and applications

CVE-2026-123865

Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdown

Severity
High 7.5
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Fixed in
22.23.5, 24.22.3, 26.13.1
Weakness
Uncontrolled resource consumption (CWE-400)
Attack
Over the network · No login needed · No user action needed
Attacker can
Take it down
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Sources
CVE Program

Description

An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

From the CVE Program.

Affected software

SoftwareAffected versions
Node.jsServers and applications · cna:nodejs|node
  • From 0.0.0 before 22.23.5
  • From 23.0.0 before 24.22.3
  • From 25.0.0 before 26.13.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-123865