CVE-2026-123868 · Runtime
NO FIX YET · SEE WHAT TO DO
Node.js HTTP/2 servers queue inbound DATA frames on undrained streams without charging that memory to any session limit. A remote client can send many one-byte DATA frames and make the server retain hundreds of megabytes of memory, which can exhaust it.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any server running Node.js 26.x or 24.x that accepts HTTP/2 connections from clients is exposed, since the client needs no account. The sources do not say whether default configurations are affected beyond the memory accounting gap, so the exposure of HTTP/1.1-only servers is unknown but presumably not affected.
Not affected if behind-proxy-terminating-http2, http1-only
Who cares http2, node.js, self-hosted
node --version and check whether it is a 26.x or 24.x release.http2 (for example require('http2') or a framework that serves HTTP/2).maxSessionMemory and whether streams are left undrained.An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x.
This page as .md · .json · CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.