Heap Buffer Overflow Vulnerability in Node.js Affecting HTTP/2 Alt-Svc Implementation

CVE-2026-123828

What is CVE-2026-123828?

A vulnerability in Node.js allows a remote, unauthenticated attacker to exploit a one-byte heap buffer overflow through improper handling of the :authority header in HTTP/2 Alt-Svc implementation. When an application provides an attacker-manipulated value to Http2Session.altsvc(), it causes the allocation of a buffer based on the origin length and mistakenly writes one byte beyond the allocated memory. This out-of-bounds write can trigger process aborts and can be leveraged as a means for remote heap corruption, affecting versions 26.x and 24.x of Node.js.

References