Memory Exhaustion Issue in Node.js for Unauthenticated HTTP/2 Clients

CVE-2026-123868

What is CVE-2026-123868?

A vulnerability exists in Node.js where unauthenticated HTTP/2 clients can exploit server memory usage. The issue arises because inbound DATA frames are processed without properly accounting for the queued memory, leading to significant retention of memory resources as these frames fill the server's receive window. Each small DATA frame consumes bandwidth disproportionately compared to the memory released, ultimately resulting in potential server performance degradation or outages. This issue impacts Node.js versions 26.x and 24.x, necessitating prompt attention from developers and system administrators to mitigate risks.

References