Memory Leak and Socket Management Issue in Node.js by OpenJS Foundation

CVE-2026-123865

What is CVE-2026-123865?

This vulnerability allows an unauthenticated HTTP/2 client to exploit a memory leak and improperly manage file descriptors on the Node.js server. When a protocol error occurs, such as an oversized frame header during an active session shutdown, it can lead to a state where the session becomes stranded in CLOSE_WAIT, holding onto HTTP/2 state information and consuming server resources indefinitely. The attacker can initiate a shutdown remotely using the GOAWAY(NO_ERROR) frame, making it a reliable exploit against default HTTP/2 servers. This issue stems from a previous incomplete fix of a related vulnerability, emphasizing a critical need for proper session management in Node.js.

References