{"id":"CVE-2026-123868","kind":"vulnerability","aliases":["CVE-2026-123868"],"related":[],"title":"Node.js: unauthenticated HTTP/2 client can exhaust server memory via DATA frames","description":"An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x.","summary":"Node.js HTTP/2 servers queue inbound DATA frames on undrained streams without charging that memory to any session limit. A remote client can send many one-byte DATA frames and make the server retain hundreds of megabytes of memory, which can exhaust it.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http2","node.js","runtime","self-hosted"],"not_affected_if":["behind-proxy-terminating-http2","http1-only"],"how_to_check":"- Run `node --version` and check whether it is a 26.x or 24.x release.\n- Check whether the application uses `http2` (for example `require('http2')` or a framework that serves HTTP/2).\n- Check whether the server sets `maxSessionMemory` and whether streams are left undrained.","fix":"- Affected: Node.js 26.x and 24.x. Fixed versions: unknown from the sources.","status":"open","published_at":"2026-11-11T19:17:33+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","triaged_at":"2026-11-11T19:30:22+00:00","updated_at":"2026-11-11T19:30:22+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-11T19:30:22Z","model":"claude-haiku-5-5","output":{"fix":"- Affected: Node.js 26.x and 24.x. Fixed versions: unknown from the sources.","reach":"internet","title":"Node.js: unauthenticated HTTP/2 client can exhaust server memory via DATA frames","impact":"medium","summary":"Node.js HTTP/2 servers queue inbound DATA frames on undrained streams without charging that memory to any session limit. A remote client can send many one-byte DATA frames and make the server retain hundreds of megabytes of memory, which can exhaust it.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["node.js","http2","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote client exhausts server memory, crashing the Node.js process","analyst_note":"Confirm fixed Node.js versions for 26.x and 24.x and whether a patch or setting mitigates it, from the nvd entry or the Node.js security release notes.","how_to_check":"- Run `node --version` and check whether it is a 26.x or 24.x release.\n- Check whether the application uses `http2` (for example `require('http2')` or a framework that serves HTTP/2).\n- Check whether the server sets `maxSessionMemory` and whether streams are left undrained.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["http1-only","behind-proxy-terminating-http2"],"who_is_affected":"Any server running Node.js 26.x or 24.x that accepts HTTP/2 connections from clients is exposed, since the client needs no account. The sources do not say whether default configurations are affected beyond the memory accounting gap, so the exposure of HTTP/1.1-only servers is unknown but presumably not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000808,"input_tokens":4765,"output_tokens":662,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123868':14A,17A '-2026':13A,16A '10':151C '114':161C '24':212C '26':209C 'account':119C,131C 'admiss':195C 'affect':207C 'bound':184C 'budget':88C 'buffer':96C,117C 'byte':50B,146C,153C,162C 'canaddstream':193C 'charg':35B,84C,107C 'client':4A,44B,69C 'connect':171C 'counter':199C 'creat':93C 'current':111C 'cve':12A,15A 'data':10A,29B,51B,77C,91C,147C 'exhaust':6A,65B,71C 'fill':137C 'frame':11A,30B,52B,92C,148C,155C,164C 'gate':194C 'growth':186C 'host':23B 'http/2':3A,25B,68C 'http2':18B 'http2session':192C 'hundr':58B,174C 'immedi':125C 'inbound':28B,76C,90C 'javascript':95C 'limit':41B 'make':54B 'mani':47B 'maxsessionmemori':182C 'megabyt':60B,176C,180C 'memori':8A,37B,62B,74C,113C 'neither':183C 'never':201C 'new':189C 'node.js':1A,19B,24B,72C,208C 'noth':106C,133C 'one':49B,94C,145C,170C 'one-byt':48B,144C 'pars':122C 'pay':149C 'peer':135C 'per':154C,163C 'queu':78C,129C 'queue':27B,104C,109C,204C 'read':116C 'readabl':103C 'receiv':100C,141C 'refus':188C 'releas':124C 'remot':43B 'retain':57B,159C,173C 'runtim':20B 'see':202C 'self':22B 'self-host':21B 'send':46B 'sent':181C 'server':7A,26B,56B,73C,158C 'session':40B,87C,112C 'singl':167C 'socket':115C 'stay':128C 'stream':33B,82C,101C,139C,168C,190C 'ten':178C 'unauthent':2A,67C 'undrain':32B,81C 'via':9A 'view':97C 'vulner':206C 'whatev':127C 'window':142C 'wire':152C 'without':34B 'x':210C,213C","nicknames":[],"mitigations":[],"who_affected":"Any server running Node.js 26.x or 24.x that accepts HTTP/2 connections from clients is exposed, since the client needs no account. The sources do not say whether default configurations are affected beyond the memory accounting gap, so the exposure of HTTP/1.1-only servers is unknown but presumably not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["http2","medium","nodejs","runtime","selfhosted"],"campaign_type":null,"search_a":"'-123868':14A,17A '-2026':13A,16A 'client':4A 'cve':12A,15A 'data':10A 'exhaust':6A 'frame':11A 'http/2':3A 'memori':8A 'node.js':1A 'server':7A 'unauthent':2A 'via':9A","search_b":"'byte':50B 'charg':35B 'client':44B 'data':29B,51B 'exhaust':65B 'frame':30B,52B 'host':23B 'http/2':25B 'http2':18B 'hundr':58B 'inbound':28B 'limit':41B 'make':54B 'mani':47B 'megabyt':60B 'memori':37B,62B 'node.js':19B,24B 'one':49B 'one-byt':48B 'queue':27B 'remot':43B 'retain':57B 'runtim':20B 'self':22B 'self-host':21B 'send':46B 'server':26B,56B 'session':40B 'stream':33B 'undrain':32B 'without':34B","search_c":"'10':151C '114':161C '24':212C '26':209C 'account':119C,131C 'admiss':195C 'affect':207C 'bound':184C 'budget':88C 'buffer':96C,117C 'byte':146C,153C,162C 'canaddstream':193C 'charg':84C,107C 'client':69C 'connect':171C 'counter':199C 'creat':93C 'current':111C 'data':77C,91C,147C 'exhaust':71C 'fill':137C 'frame':92C,148C,155C,164C 'gate':194C 'growth':186C 'http/2':68C 'http2session':192C 'hundr':174C 'immedi':125C 'inbound':76C,90C 'javascript':95C 'maxsessionmemori':182C 'megabyt':176C,180C 'memori':74C,113C 'neither':183C 'never':201C 'new':189C 'node.js':72C,208C 'noth':106C,133C 'one':94C,145C,170C 'one-byt':144C 'pars':122C 'pay':149C 'peer':135C 'per':154C,163C 'queu':78C,129C 'queue':104C,109C,204C 'read':116C 'readabl':103C 'receiv':100C,141C 'refus':188C 'releas':124C 'retain':159C,173C 'see':202C 'sent':181C 'server':73C,158C 'session':87C,112C 'singl':167C 'socket':115C 'stay':128C 'stream':82C,101C,139C,168C,190C 'ten':178C 'unauthent':67C 'undrain':81C 'view':97C 'vulner':206C 'whatev':127C 'window':142C 'wire':152C 'x':210C,213C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T19:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"ce714d77-add3-4f53-aff5-83d477b104bb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123868","severity":null,"published_at":"2026-11-11T19:17:33+00:00","modified_at":"2026-11-11T19:17:33+00:00","first_seen_at":"2026-11-11T19:28:45+00:00","fetched_at":"2026-11-11T19:28:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}