---
id: "CVE-2026-123863"
page: "https://infrastack.ai/live/CVE-2026-123863"
kind: "vulnerability"
aliases: ["CVE-2026-123863"]
title: "Node.js: HTTP/2 session teardown assertion lets any client crash server"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["http2", "node.js", "runtime", "self-hosted"]
not_affected_if: ["no-http2-server", "older-node-versions"]
published_at: "2026-11-11T19:17:32+00:00"
first_seen_at: "2026-11-11T19:28:45+00:00"
updated_at: "2026-11-11T19:29:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123863", "first_seen_at": "2026-11-11T19:28:45+00:00"}]
exploit_sources: []
---

# Node.js: HTTP/2 session teardown assertion lets any client crash server

Link for people: https://infrastack.ai/live/CVE-2026-123863 (this .md is for agents)

A crafted HTTP/2 request sequence makes Node.js hit an internal assertion during session teardown, terminating the process. An unauthenticated client can repeat this to take the server down over TLS or cleartext HTTP/2.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `node --version` and check whether it is 26.x at or after 26.9.0, or 24.x at or after 24.22.0.
- Look for `http2.createServer` or `http2.createSecureServer` in your application code, where handlers respond before the request body has finished.

## Fix

- Node.js 26.x: `26.9.0` or later per the affected range; the fixed version for 26.x is not stated beyond the affected range.
- Node.js 24.x: move past `24.22.0` (the affected range starts there); the exact fixed release is not stated in the sources.

## Timeline

- 2026-11-11T19:28:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123863

## From the sources

A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_