CVE-2026-123865

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123865", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-11-06T16:14:27.277Z", "datePublished": "2026-11-11T18:19:36.284Z", "dateUpdated": "2026-11-11T18:19:36.284Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-11-11T18:19:36.284Z"}, "title": "Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdown", "descriptions": [{"lang": "en", "value": "An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x.", "supportingMedia": [{"type": "text/markdown", "base64": false, "value": "An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, `nghttp2` tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in `CLOSE_WAIT` and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending `GOAWAY(NO_ERROR)`, so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected `nghttp2` internal terminations by watching for `GOAWAY` sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}]}], "credits": [{"lang": "en", "value": "pimterry", "type": "reporter"}, {"lang": "en", "value": "mcollina", "type": "remediation developer"}, {"lang": "en", "value": "aduh95", "type": "coordinator"}], "affected": [{"vendor": "nodejs", "product": "node", "defaultStatus": "unaffected", "versions": [{"version": "0.0.0", "status": "affected", "lessThan": "22.23.5", "versionType": "semver"}, {"version": "23.0.0", "status": "affected", "lessThan": "24.22.3", "versionType": "semver"}, {"version": "25.0.0", "status": "affected", "lessThan": "26.13.1", "versionType": "semver"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "Uncontrolled Resource Consumption"}]}], "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases", "tags": ["vendor-advisory"]}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "x_generator": {"engine": "nodejs-private/security-release publish-cves"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "node", "vendor": "nodejs", "versions": [{"lessThan": "22.23.5", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "24.22.3", "status": "affected", "version": "23.0.0", "versionType": "semver"}, {"lessThan": "26.13.1", "status": "affected", "version": "25.0.0", "versionType": "semver"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x."}], "id": "CVE-2026-123865", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}, "published": "2026-11-11T19:17:33.000", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}

{"bugzilla": {"description": "nodejs: Node.js: Denial of service via HTTP/2 session resource leak during shutdown", "id": "2571831", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571831"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service (DoS) through resource exhaustion by permanently leaking server memory and file descriptors. By initiating a connection shutdown and sending a protocol-violating HTTP/2 frame, the internal protocol handler terminates the session without Node.js properly releasing the associated state. Over time, an attacker can accumulate dangling connections, ultimately exhausting server resources and disrupting service availability."], "mitigation": {"lang": "en:us", "value": "1. Terminate HTTP/2 at an upstream reverse proxy:\nConfigure an edge reverse proxy (such as HAProxy, Envoy, or Apache HTTP Server) to handle client HTTP/2 traffic and proxy requests to the backend Node.js application over standard HTTP/1.1. Alternatively, if HTTP/2 capabilities are not required by the application, configure the Node.js application to use the standard `http` or `https` modules instead of `http2`.\n2. Restrict network access using firewalld:\nIf direct exposure cannot be avoided, limit network access to the Node.js HTTP/2 port so only trusted internal clients or reverse proxies can reach it:\nfirewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET>\nfirewall-cmd --permanent --zone=trusted --add-port=<NODE_PORT>/tcp\nfirewall-cmd --reload\nCaveats:\nRestricting access via firewall rules blocks untrusted external networks from communicating directly with the service. Reloading firewalld applies changes immediately. Reconfiguring the Node.js application or underlying service settings requires restarting the Node.js process, which will temporarily interrupt active client connections."}, "name": "CVE-2026-123865", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs20", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs22", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs24", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs25", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs26", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-11T18:19:36Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123865\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123865\nhttps://cna.openjsf.org/security-advisories.html\nhttps://nodejs.org/en/blog/vulnerability/november-2026-security-releases"], "statement": "This vulnerability is rated as Important severity because remote, unauthenticated actors can induce memory and file descriptor leaks with minimal effort, resulting in a complete denial of service. Exposure is limited to deployments where Node.js applications directly handle HTTP/2 connections. Applications running standard HTTP/1.1 or those deployed behind front-end reverse proxies that terminate HTTP/2 traffic are not susceptible to this attack.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,22.23.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0,24.22.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.0.0,26.13.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "node", "source": "cna", "vendor": "nodejs"}, "product": "nodejs", "vendor": "nodejs"}], "created": "2026-11-12T13:45:03.648934+00:00", "updated": "2026-11-12T18:30:06.848058+00:00", "vendors": ["nodejs", "nodejs$PRODUCT$nodejs"]}