{"id":"CVE-2026-123865","kind":"vulnerability","aliases":["CVE-2026-123865"],"related":[],"title":"Node.js: unauthenticated HTTP/2 client leaks server memory and file descriptors","description":"An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x.","summary":"A remote client can send a crafted sequence of HTTP/2 frames during session shutdown so that Node.js never cleans up the session. Each such connection keeps its socket in CLOSE_WAIT and its HTTP/2 state in memory indefinitely, which lets an attacker exhaust server resources.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"node.js","fixed":["22.23.5","24.22.3","26.13.1"],"affected":">= 22.0.0, < 22.23.5 || >= 24.0.0, < 24.22.3 || >= 26.0.0, < 26.13.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["http2","node.js","runtime","self-hosted"],"not_affected_if":["http1-only-behind-proxy","no-http2-server"],"how_to_check":"Run \"node --version\". Exposed if it is below 22.23.5 (22.x), 24.22.3 (24.x) or 26.13.1 (26.x).\nSearch the code for http2.createServer or http2.createSecureServer. Any server that accepts HTTP/2 from untrusted clients is exposed; the advisory says default HTTP/2 servers are reliably affected.\nSigns of attack: many sockets stuck in CLOSE_WAIT (for example \"ss -tan state close-wait\") and growing memory or file descriptor use.","fix":"Upgrade to Node.js 26.13.1, 24.22.3 or 22.23.5 (or later) and restart the service.","status":"open","published_at":"2026-11-11T19:17:33+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","triaged_at":"2026-11-11T19:30:09+00:00","updated_at":"2026-11-11T19:33:31+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-11-11T19:30:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Node.js: unauthenticated HTTP/2 client leaks server memory and file descriptors","impact":"medium","summary":"A remote client can send a crafted sequence of HTTP/2 frames during session shutdown so that Node.js never cleans up the session. Each such connection keeps its socket in CLOSE_WAIT and its HTTP/2 state in memory indefinitely, which lets an attacker exhaust server resources.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["node.js","http2","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker exhausts server memory and file descriptors over time.","analyst_note":"Find the patched Node.js versions for 26.x, 24.x and 22.x and any official advisory text, since the sources given state no fix.","how_to_check":"- Run `node --version` and compare against the affected lines 26.x, 24.x and 22.x.\n- Check whether the application creates HTTP/2 servers with `http2.createServer` or `http2.createSecureServer`; if not, the exposure is unknown.\n- unknown for anything beyond this, as the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-http2-server"],"who_is_affected":"Servers running Node.js 26.x, 24.x or 22.x that accept HTTP/2 connections from untrusted clients are exposed. The sources say this affects default HTTP/2 servers and needs no authentication. Applications that do not serve HTTP/2 are likely not affected, but the sources do not say this explicitly.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000792,"input_tokens":4761,"output_tokens":631,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the patched Node.js versions for 26.x, 24.x and 22.x and any official advisory text, since the sources given state no fix.","search":"'-123865':13A,16A '-2026':12A,15A,173C '-48937':174C '22':211C '24':208C '26':206C 'affect':204C 'alreadi':99C,199C 'arriv':194C 'attack':65B,143C,145C 'case':170C 'clean':42B 'client':4A,26B,72C 'close':53B,120C 'connect':48B,131C 'cost':140C 'craft':30B 'cve':11A,14A,172C 'dangl':114C 'default':161C 'descriptor':10A,81C 'detect':177C 'error':88C,155C 'exampl':90C 'exhaust':66B 'file':9A,80C 'fix':169C,176C 'frame':34B,93C 'goaway':153C,184C 'header':94C 'held':133C 'host':23B 'http/2':3A,33B,57B,71C,127C,162C 'http2':18B 'incomplet':168C 'incomplete-fix':167C 'indefinit':61B,136C 'intern':107C,179C 'keep':49B 'leak':5A,75C 'leav':112C 'let':63B 'memori':7A,60B,78C,135C 'miss':191C 'never':41B,110C 'nghttp2':102C,178C 'node.js':1A,17A,19B,40B,76C,109C,125C,205C 'notic':111C 'overs':92C 'peer':84C 'perman':74C 'protocol':87C 'reliabl':159C 'remot':25B,150C 'resourc':68B 'runtim':20B 'self':22B 'self-host':21B 'send':28B,152C 'sent':185C 'sequenc':31B 'server':6A,67B,77C,163C 'session':36B,45B,97C,105C,115C,197C 'shut':100C,188C,200C 'shutdown':37B,149C 'socket':51B,117C 'start':147C 'state':58B,128C 'stay':118C 'tear':103C 'termin':180C,192C 'trigger':85C 'unauthent':2A,70C 'vulner':203C 'wait':54B,121C 'watch':182C 'x':207C,209C,212C","nicknames":[],"mitigations":[],"who_affected":"Servers running Node.js 22.x, 24.x or 26.x below the fixed versions that accept HTTP/2 connections (http2.createServer or createSecureServer, directly or via a framework) from untrusted clients. No authentication is needed, and the Node.js advisory says it is reliable against default HTTP/2 servers. Apps that only serve HTTP/1.1, or sit behind a proxy that talks HTTP/1.1 to Node, can likely skip it; the advisory does not state this explicitly.","tier":"B","verified":{"fix":{"at":"2026-11-11T19:33:31Z","by":"analyst","doc":"https://nodejs.org/en/blog/release/v22.23.5","run_id":3587},"products":{"at":"2026-11-11T19:33:31Z","by":"analyst","doc":"https://nodejs.org/en/blog/release/v22.23.5","run_id":3587},"who_affected":{"at":"2026-11-11T19:33:31Z","by":"analyst","doc":"https://nodejs.org/en/blog/release/v22.23.5","run_id":3587}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["nodejs"],"ptokens":["nodejs"],"labels":["high","http2","nodejs","runtime","selfhosted"],"campaign_type":null,"search_a":"'-123865':13A,16A '-2026':12A,15A 'client':4A 'cve':11A,14A 'descriptor':10A 'file':9A 'http/2':3A 'leak':5A 'memori':7A 'node.js':1A,17A 'server':6A 'unauthent':2A","search_b":"'attack':65B 'clean':42B 'client':26B 'close':53B 'connect':48B 'craft':30B 'exhaust':66B 'frame':34B 'host':23B 'http/2':33B,57B 'http2':18B 'indefinit':61B 'keep':49B 'let':63B 'memori':60B 'never':41B 'node.js':19B,40B 'remot':25B 'resourc':68B 'runtim':20B 'self':22B 'self-host':21B 'send':28B 'sequenc':31B 'server':67B 'session':36B,45B 'shutdown':37B 'socket':51B 'state':58B 'wait':54B","search_c":"'-2026':173C '-48937':174C '22':211C '24':208C '26':206C 'affect':204C 'alreadi':99C,199C 'arriv':194C 'attack':143C,145C 'case':170C 'client':72C 'close':120C 'connect':131C 'cost':140C 'cve':172C 'dangl':114C 'default':161C 'descriptor':81C 'detect':177C 'error':88C,155C 'exampl':90C 'file':80C 'fix':169C,176C 'frame':93C 'goaway':153C,184C 'header':94C 'held':133C 'http/2':71C,127C,162C 'incomplet':168C 'incomplete-fix':167C 'indefinit':136C 'intern':107C,179C 'leak':75C 'leav':112C 'memori':78C,135C 'miss':191C 'never':110C 'nghttp2':102C,178C 'node.js':76C,109C,125C,205C 'notic':111C 'overs':92C 'peer':84C 'perman':74C 'protocol':87C 'reliabl':159C 'remot':150C 'send':152C 'sent':185C 'server':77C,163C 'session':97C,105C,115C,197C 'shut':100C,188C,200C 'shutdown':149C 'socket':117C 'start':147C 'state':128C 'stay':118C 'tear':103C 'termin':180C,192C 'trigger':85C 'unauthent':70C 'vulner':203C 'wait':121C 'watch':182C 'x':207C,209C,212C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-03T23:00:00+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123865","severity":null,"published_at":"2026-11-11T19:17:33+00:00","modified_at":"2026-11-11T19:17:33+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","fetched_at":"2026-11-11T19:28:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123865:3587","url":"https://nodejs.org/en/blog/release/v26.13.1","severity":null,"published_at":"2026-11-11T19:33:26+00:00","modified_at":"2026-11-11T19:33:31+00:00","first_seen_at":"2026-11-11T19:33:26+00:00","fetched_at":"2026-11-11T19:33:31+00:00","note":"Fix to how-to-check text (shell had dropped a command).","cites":["https://nodejs.org/en/blog/release/v26.13.1","https://nodejs.org/en/blog/release/v24.22.3","https://nodejs.org/en/blog/release/v22.23.5"]}],"documents":[{"id":65753,"url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases","title":"Node.js November 11, 2026 Security Releases","kind":"advisory","source":"advisory","publisher":null,"text":"Wednesday, November 11, 2026 Security Releases","published_at":"2026-11-03T23:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":128323,"url":"https://nodejs.org/en/blog/release/v26.13.1","title":"Node.js 26.13.1 (LTS)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":128317,"url":"https://nodejs.org/en/blog/release/v24.22.3","title":"Node.js 24.22.3 (LTS)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":128327,"url":"https://nodejs.org/en/blog/release/v22.23.5","title":"Node.js 22.23.5 (LTS)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}