---
id: "CVE-2026-123828"
page: "https://infrastack.ai/live/CVE-2026-123828"
kind: "vulnerability"
aliases: ["CVE-2026-123828"]
title: "Node.js: HTTP/2 Alt-Svc overflow lets remote requests corrupt process memory"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Node.js", "fixed": [], "affected": "", "ecosystem": "runtime"}]
ecosystems: ["runtime"]
tags: ["http2", "nodejs", "runtime", "servers"]
not_affected_if: ["no-altsvc-with-request-input"]
published_at: "2026-11-11T19:17:30+00:00"
first_seen_at: "2026-11-11T19:28:45+00:00"
updated_at: "2026-11-11T19:30:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123828", "first_seen_at": "2026-11-11T19:28:45+00:00"}]
exploit_sources: []
---

# Node.js: HTTP/2 Alt-Svc overflow lets remote requests corrupt process memory

Link for people: https://infrastack.ai/live/CVE-2026-123828 (this .md is for agents)

Node.js writes one byte past a heap buffer in HTTP/2 Alt-Svc handling when an app passes an attacker-controlled value such as the :authority header to Http2Session.altsvc(). A single long but valid request can abort the process and corrupt heap memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- runtime:Node.js affected range not listed fixed no fixed version listed

## How to check

- Run `node --version` and check whether it reports 24.x or 26.x.
- Search the codebase for calls to `Http2Session.altsvc(` and check whether the origin comes from request headers such as :authority.

## Timeline

- 2026-11-11T19:28:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123828

## From the sources

A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_