Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-123863

Unauthenticated HTTP/2 assertion crash in Node.js

CVSS 3.0
8.2 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-123863 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server over TLS or cleartext. The client leaves an Http2Stream holding nghttp2 header buffers after it is removed from the session but not detached; session destruction then fails a memory check and exits. A default handler that responds before the request body ends is enough. Node.js 26.x since 26.9.0 and 24.x since 24.22.0 are affected; the CVE-2024-27983 fix did not cover this path.

What to do: Apply the Node.js Project November 11 security releases for CVE-2026-123863. Fixed versions are not named.

ProductAffected
Node.js26.x since 26.9.0 and 24.x since 24.22.0
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).

Weakness
CWE-617
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story