Node.js HTTP/2 Session Teardown Vulnerability Affects Multiple Versions

CVE-2026-123863

What is CVE-2026-123863?

A vulnerability exists in Node.js HTTP/2 session teardown that permits unauthenticated clients to interrupt the server's operation. This occurs due to a failure to detach specific nghttp2-allocated header buffers from the stream when the session ends. As a result, when the session is terminated, the memory accounting remains incorrect, leading to a process termination. The issue arises from default HTTP/2 configurations where a server responds before the complete request body is sent, triggering the abort scenario. This is a variant of a previous vulnerability and affects Node.js versions 26.x (from 26.9.0) and 24.x (from 24.22.0).

References