Executive brief
Node.js is a widely-used JavaScript runtime for building server applications. A flaw in its HTTP/2 protocol handling allows attackers to bypass memory limits and trigger memory exhaustion on servers, potentially causing denial of service or application crashes. This affects multiple active versions of Node.js and requires no authentication or special privileges to exploit.
Technical details
The vulnerability exists in Node.js HTTP/2 header block handling, where retained header blocks can evade the maxSessionMemory limit enforcement. An attacker can craft malicious HTTP/2 connections that accumulate header memory beyond the configured session memory threshold, leading to heap exhaustion. The attack vector is network-based and does not require authentication or user interaction. Exploitation can result in remote denial of service through memory exhaustion. Patches have been released in Node.js 26.x, 24.x, and 22.x versions.
Affected products
- OpenJS Foundation Node.js 24.x, 22.x
Timeline
- 2026-07-29: disclosed: Security advisory published
- 2026-08-04: advisory: CVE-2026-56846 published on NVD