Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-123868

Unauthenticated HTTP/2 memory exhaustion in Node.js 24.x and 26.x

CVSS 3.0
5.9 medium
EPSS
—
Published
·
Modified
Analyze CVE-2026-123868 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

Node.js does not charge inbound HTTP/2 DATA queued on an undrained stream to the session memory budget, so each one-byte frame can leave a much larger Buffer in the readable queue. An unauthenticated remote client can fill a stream receive window and retain hundreds of megabytes from tens of megabytes sent; maxSessionMemory neither bounds that growth nor blocks new streams. Node.js 24.x and 26.x servers that accept HTTP/2 are affected. Impact is denial of service.

What to do: Apply the Node.js November 11 security release for CVE-2026-123868. Fixed builds are not named here.

ProductAffected
Node.js24.x and 26.x
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x.

Weakness
CWE-400
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story