Executive brief
A vulnerability in the Node.js HTTP/2 client allows a malicious server to overwhelm a connecting application by sending an unlimited number of specific data frames. This can cause the application to consume all available memory, leading to a crash or service outage. Organizations using Node.js to connect to external web services via HTTP/2 are at risk of denial-of-service attacks.
Technical details
The vulnerability is classified as uncontrolled resource consumption (CWE-400) within the Node.js node:http2 client implementation. A malicious or compromised server can exploit this by sending an unbounded number of ORIGIN frames to a connecting Node.js client. Because the client does not properly limit the processing or storage of these frames, it leads to continuous memory growth until the process reaches an Out of Memory (OOM) state and terminates. This is a remote, unauthenticated attack requiring no user interaction. The issue has been addressed in Node.js versions 22.23.0, 24.17.0, and 26.3.1.
Affected products
- Node.js Node.js 22.x < 22.23.0, 24.x < 24.17.0, 26.x < 26.3.1
Timeline
- 2026-06-18: patched: Security releases 22.23.0, 24.17.0, and 26.3.1 made available.
- 2026-06-26: disclosed: CVE-2026-48619 published.