---
id: "CVE-2026-123865"
page: "https://infrastack.ai/live/CVE-2026-123865"
kind: "vulnerability"
aliases: ["CVE-2026-123865"]
title: "Node.js: unauthenticated HTTP/2 client leaks server memory and file descriptors"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "node.js", "fixed": ["22.23.5", "24.22.3", "26.13.1"], "affected": ">= 22.0.0, < 22.23.5 || >= 24.0.0, < 24.22.3 || >= 26.0.0, < 26.13.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["http2", "node.js", "runtime", "self-hosted"]
not_affected_if: ["http1-only-behind-proxy", "no-http2-server"]
published_at: "2026-11-11T19:17:33+00:00"
first_seen_at: "2026-11-11T19:28:45+00:00"
updated_at: "2026-11-11T19:33:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123865", "first_seen_at": "2026-11-11T19:28:45+00:00"}, {"source": "analyst", "url": "https://nodejs.org/en/blog/release/v26.13.1", "first_seen_at": "2026-11-11T19:33:26+00:00", "cites": ["https://nodejs.org/en/blog/release/v26.13.1", "https://nodejs.org/en/blog/release/v24.22.3", "https://nodejs.org/en/blog/release/v22.23.5"]}]
exploit_sources: []
---

# Node.js: unauthenticated HTTP/2 client leaks server memory and file descriptors

Link for people: https://infrastack.ai/live/CVE-2026-123865 (this .md is for agents)

A remote client can send a crafted sequence of HTTP/2 frames during session shutdown so that Node.js never cleans up the session. Each such connection keeps its socket in CLOSE_WAIT and its HTTP/2 state in memory indefinitely, which lets an attacker exhaust server resources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:node.js affected >= 22.0.0, < 22.23.5 || >= 24.0.0, < 24.22.3 || >= 26.0.0, < 26.13.1 fixed 22.23.5, 24.22.3, 26.13.1

## How to check

Run "node --version". Exposed if it is below 22.23.5 (22.x), 24.22.3 (24.x) or 26.13.1 (26.x).
Search the code for http2.createServer or http2.createSecureServer. Any server that accepts HTTP/2 from untrusted clients is exposed; the advisory says default HTTP/2 servers are reliably affected.
Signs of attack: many sockets stuck in CLOSE_WAIT (for example "ss -tan state close-wait") and growing memory or file descriptor use.

## Fix

Upgrade to Node.js 26.13.1, 24.22.3 or 22.23.5 (or later) and restart the service.

## Timeline

- 2026-11-11T19:28:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123865
- 2026-11-11T19:33:26+00:00 analyst https://nodejs.org/en/blog/release/v26.13.1 — Fix to how-to-check text (shell had dropped a command).

## Documents

- [advisory] Node.js November 11, 2026 Security Releases https://nodejs.org/en/blog/vulnerability/november-2026-security-releases
- [fix] Node.js 26.13.1 (LTS) https://nodejs.org/en/blog/release/v26.13.1
- [fix] Node.js 24.22.3 (LTS) https://nodejs.org/en/blog/release/v24.22.3
- [fix] Node.js 22.23.5 (LTS) https://nodejs.org/en/blog/release/v22.23.5

## From the sources

An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_