CVE-2026-123863

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123863", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-11-06T16:12:44.473Z", "datePublished": "2026-11-11T18:16:12.733Z", "dateUpdated": "2026-11-11T18:16:12.733Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-11-11T18:16:12.733Z"}, "title": "Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown", "descriptions": [{"lang": "en", "value": "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).", "supportingMedia": [{"type": "text/markdown", "base64": false, "value": "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an `Http2Stream` that still holds `nghttp2`-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when `~Http2Session()` runs the memory accounting is nonzero and the `CHECK_EQ(current_nghttp2_memory_, 0)` assertion fails, terminating the process. The trigger needs only a default `http2` server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."}]}], "credits": [{"lang": "en", "value": "Chris Rohlf in collaboration with Claude and Anthropic Research", "type": "reporter"}, {"lang": "en", "value": "mcollina", "type": "remediation developer"}, {"lang": "en", "value": "UlisesGascon", "type": "remediation reviewer"}, {"lang": "en", "value": "pimterry", "type": "remediation reviewer"}, {"lang": "en", "value": "ronag", "type": "remediation reviewer"}, {"lang": "en", "value": "aduh95", "type": "coordinator"}], "affected": [{"vendor": "nodejs", "product": "node", "defaultStatus": "unaffected", "versions": [{"version": "24.0.0", "status": "affected", "lessThan": "24.22.3", "versionType": "semver"}, {"version": "25.0.0", "status": "affected", "lessThan": "26.13.1", "versionType": "semver"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "Reachable Assertion"}]}], "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH"}}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases", "tags": ["vendor-advisory"]}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "x_generator": {"engine": "nodejs-private/security-release publish-cves"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "node", "vendor": "nodejs", "versions": [{"lessThan": "24.22.3", "status": "affected", "version": "24.0.0", "versionType": "semver"}, {"lessThan": "26.13.1", "status": "affected", "version": "25.0.0", "versionType": "semver"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."}], "id": "CVE-2026-123863", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}, "published": "2026-11-11T19:17:32.577", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}

{"bugzilla": {"description": "nodejs: Node.js: Denial of Service via improper HTTP/2 session teardown", "id": "2571842", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571842"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service (DoS) by triggering an abnormal server crash during HTTP/2 session termination. By sending a request where the server responds before the request body has finished transmitting, an individual stream can outlive its parent session while retaining allocated memory. This inconsistency triggers an internal check failure during session cleanup, immediately terminating the server process."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123863", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs20", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs22", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs24", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs25", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs26", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-11T18:16:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123863\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123863\nhttps://cna.openjsf.org/security-advisories.html\nhttps://nodejs.org/en/blog/vulnerability/november-2026-security-releases"], "statement": "This vulnerability is rated as Important severity because an unauthenticated remote attacker can trigger an unexpected server crash, causing a full denial of service without requiring authentication or user interaction. In Red Hat environments, the impact directly affects deployments hosting Node.js applications that utilize the built-in HTTP/2 server module exposed to untrusted network traffic. Applications serving requests exclusively over HTTP/1.1 or situated behind reverse proxies that terminate HTTP/2 traffic are not exposed to this failure path.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[24.0.0,24.22.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.0.0,26.13.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "node", "source": "cna", "vendor": "nodejs"}, "product": "nodejs", "vendor": "nodejs"}], "created": "2026-11-12T13:45:03.649170+00:00", "updated": "2026-11-12T18:30:06.849367+00:00", "vendors": ["nodejs", "nodejs$PRODUCT$nodejs"]}