UpHeron
All vulnerabilities

Servers and applications

CVE-2026-48937

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.

Severity
High 7.5
Published
18 Jun 2026
Last changed
18 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
22.23.0, 24.17.0
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 22.0 before 22.23.0
  • From 24.0.0 before 24.17.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-48937
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-48937