# CVE-2026-123863: Node.js HTTP/2 assertion failure in session teardown denial of service

Source: https://junglewise.ai/threats/cve-2026-123863-a-reachable-assertion-in-node-js-http-2-session-teardown-lets  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-123863 · Severity: high · CVSS 8.2 · Published 2026-11-11

Node.js HTTP/2 servers process web requests from clients over secure and unsecured connections. An unauthenticated client can trigger a reachable assertion failure during session cleanup, causing the server process to crash. This is a denial-of-service attack that stops the web service, requiring a restart to restore availability.

Technologies: [OpenJS Foundation Node.js](https://junglewise.ai/threats/technologies/openjs-foundation-node-js). Vendors: [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-123863 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123863 being exploited in the wild.

**How severe is CVE-2026-123863?** High severity, with a CVSS score of 8.2, published 11 November 2026.

**Which products and versions are affected?** OpenJS Foundation Node.js 26.x (26.9.0 and later), 24.x (24.22.0 and later).

**Is there a fix for CVE-2026-123863?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123863 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123863?** Check whether you run OpenJS Foundation Node.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reachable assertion (CHECK_EQ) in Http2Session destructor fails when an Http2Stream with nghttp2-allocated header buffers outlives its session. The stream is removed from the session's stream set but never detached from nghttp2 resources, causing nonzero memory accounting at teardown time. The trigger requires only a default HTTP/2 server whose handler responds before the request body ends—typical behavior. This is an incomplete fix of CVE-2024-27983; the earlier fix only detached tracked streams.

## Affected products

- OpenJS Foundation Node.js 26.x (26.9.0 and later), 24.x (24.22.0 and later)

## Timeline

- 2026-11-11: disclosed

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://nodejs.org/en/blog/vulnerability/november-2026-security-releases](https://nodejs.org/en/blog/vulnerability/november-2026-security-releases)

## Related threats

- [Node.js TLS server use-after-destroy in deferred handshake callbacks](https://junglewise.ai/threats/cve-2026-126051-a-deferred-callback-use-after-destroy-in-node-js-tls-server)
- [Node.js https.Agent certificate validation bypass via TLS session reuse](https://junglewise.ai/threats/cve-2026-123877-a-certificate-validation-bypass-in-node-js-https-agent-lets-a)
- [Node.js HTTP/2 denial of service via NULL pointer dereference](https://junglewise.ai/threats/cve-2026-123875-a-null-pointer-dereference-in-node-js-http-2-lets-an)
- [Node.js HTTP/2 use-after-free in respondWithFile stream reset](https://junglewise.ai/threats/cve-2026-123874-a-use-after-free-in-node-js-http-2-lets-an-unauthenticated)
- [Node.js client certificate auth bypass via TLS 1.2 renegotiation servername change](https://junglewise.ai/threats/cve-2026-123872-a-client-certificate-authentication-bypass-in-node-js-tls-lets-a)