NODE.JS · CVE-2026-123865 · Runtime
FIX → 26.13.1 · 24.22.3 · 22.23.5 ✓ verified
A remote client can send a crafted sequence of HTTP/2 frames during session shutdown so that Node.js never cleans up the session. Each such connection keeps its socket in CLOSE_WAIT and its HTTP/2 state in memory indefinitely, which lets an attacker exhaust server resources.
first public Nov 3, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running Node.js 22.x, 24.x or 26.x below the fixed versions that accept HTTP/2 connections (http2.createServer or createSecureServer, directly or via a framework) from untrusted clients. No authentication is needed, and the Node.js advisory says it is reliable against default HTTP/2 servers. Apps that only serve HTTP/1.1, or sit behind a proxy that talks HTTP/1.1 to Node, can likely skip it; the advisory does not state this explicitly.
Not affected if http1-only-behind-proxy, no-http2-server
Who cares http2, node.js, self-hosted
22.23.5 (22.x), 24.22.3 (24.x) or 26.13.1 (26.x)An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 26.13.1 · 24.22.3 · 22.23.5
Upgrade to Node.js 26.13.1, 24.22.3 or 22.23.5 (or later) and restart the service.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.