CVE-2026-123868

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123868", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-11-06T16:17:16.212Z", "datePublished": "2026-11-11T18:25:01.907Z", "dateUpdated": "2026-11-11T18:25:01.907Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-11-11T18:25:01.907Z"}, "title": "Node.js is vulnerable to an HTTP/2 memory exhaustion denial of service via unaccounted inbound DATA on an undrained stream", "descriptions": [{"lang": "en", "value": "An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x.", "supportingMedia": [{"type": "text/markdown", "base64": false, "value": "An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound `DATA` frame creates one JavaScript `Buffer` view in the receiving stream's readable queue, but nothing charges that queue to `current_session_memory_`: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte `DATA` frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. `maxSessionMemory` neither bounds the growth nor refuses new streams, because `Http2Session::CanAddStream` gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x."}]}], "credits": [{"lang": "en", "value": "jiri1234", "type": "reporter"}, {"lang": "en", "value": "mcollina", "type": "remediation developer"}, {"lang": "en", "value": "aduh95", "type": "coordinator"}], "affected": [{"vendor": "nodejs", "product": "node", "defaultStatus": "unaffected", "versions": [{"version": "24.0.0", "status": "affected", "lessThan": "24.22.3", "versionType": "semver"}, {"version": "25.0.0", "status": "affected", "lessThan": "26.13.1", "versionType": "semver"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "Uncontrolled Resource Consumption"}]}], "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases", "tags": ["vendor-advisory"]}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "x_generator": {"engine": "nodejs-private/security-release publish-cves"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "node", "vendor": "nodejs", "versions": [{"lessThan": "24.22.3", "status": "affected", "version": "24.0.0", "versionType": "semver"}, {"lessThan": "26.13.1", "status": "affected", "version": "25.0.0", "versionType": "semver"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x."}], "id": "CVE-2026-123868", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}, "published": "2026-11-11T19:17:33.690", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}

{"bugzilla": {"description": "nodejs: nodejs: Denial of service via HTTP/2 memory exhaustion", "id": "2571834", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571834"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Node.js. An unauthenticated remote attacker can cause a denial of service (DoS) by exhausting server memory. By transmitting streams containing numerous small HTTP/2 data frames, incoming data is queued without being properly accounted against session memory limits. This allows an attacker to consume disproportionate amounts of system memory with relatively little network traffic, ultimately causing the server process to crash."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict access to the Node.js application to trusted networks using firewall controls, or deploy an upstream reverse proxy (such as HAProxy or NGINX) to terminate HTTP/2 traffic and forward requests to Node.js using HTTP/1.1. If the application is designed solely for local consumption, bind the listener to localhost (127.0.0.1).\nTo restrict inbound traffic on the service port to trusted source addresses using firewalld:\nfirewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_CIDR>\nfirewall-cmd --permanent --zone=public --remove-port=<PORT>/tcp\nfirewall-cmd --reload\nCaveats:\nRestricting access via firewall rules prevents untrusted clients from connecting to the application. Terminating HTTP/2 at an upstream proxy may alter client-side multiplexing characteristics and requires proxy reconfiguration.\nWarning: Reloading firewall rules with 'firewall-cmd --reload' applies changes immediately and may disrupt active network connections."}, "name": "CVE-2026-123868", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs20", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs22", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs24", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs25", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nodejs26", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-11T18:25:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123868\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123868\nhttps://cna.openjsf.org/security-advisories.html\nhttps://nodejs.org/en/blog/vulnerability/november-2026-security-releases"], "statement": "Red Hat has rated this vulnerability as Moderate severity because, although an unauthenticated remote attacker can trigger a denial of service, the flaw does not compromise data confidentiality or host integrity. Exploitation requires applications to explicitly implement Node.js native HTTP/2 server capabilities to receive untrusted traffic. In standard enterprise deployments, Node.js services are typically fronted by reverse proxies or ingress gateways, or utilize standard HTTP/1.1, which significantly reduces the likelihood of direct remote exposure.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[24.0.0,24.22.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.0.0,26.13.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "node", "source": "cna", "vendor": "nodejs"}, "product": "nodejs", "vendor": "nodejs"}], "created": "2026-11-12T13:45:03.648568+00:00", "updated": "2026-11-12T18:30:06.845412+00:00", "vendors": ["nodejs", "nodejs$PRODUCT$nodejs"]}