CVE-2026-123863 · Runtime
NO FIX YET · SEE WHAT TO DO
A crafted HTTP/2 request sequence makes Node.js hit an internal assertion during session teardown, terminating the process. An unauthenticated client can repeat this to take the server down over TLS or cleartext HTTP/2.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running Node.js 26.x from 26.9.0 or 24.x from 24.22.0 that use the built-in HTTP/2 server, over TLS or cleartext. The trigger needs only a default http2 server whose handler responds before the request body ends, which the sources describe as typical. Applications that do not expose Node's HTTP/2 server are not described as exposed.
Not affected if no-http2-server, older-node-versions
Who cares http2, node.js, self-hosted
node --version and check whether it is 26.x at or after 26.9.0, or 24.x at or after 24.22.0.http2.createServer or http2.createSecureServer in your application code, where handlers respond before the request body has finished.26.9.0 or later per the affected range; the fixed version for 26.x is not stated beyond the affected range.24.22.0 (the affected range starts there); the exact fixed release is not stated in the sources.A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
This page as .md · .json · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.