Okta patches Cloud Services after Node.js security releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
52
CVE-2026-123828
Heap overflow in Node.js HTTP/2 Alt-Svc handling
- CVSS 3.0
- 5.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling occurs when an application passes an attacker-controlled value, such as a request :authority header, to Http2Session.altsvc(). A remote, unauthenticated attacker can send one request with a long, syntactically valid :authority, writing one byte past an allocation. That aborts the process and is a remote heap-corruption primitive. Node.js 26.x and 24.x are affected.
What to do: Apply the Node.js November 11 security release for CVE-2026-123828. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| Node.js | 26.x and 24.x |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x.
- Weakness
- CWE-122
- Vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H