Out of Memory Vulnerability in Node.js HTTP/2 Client Affects Multiple Versions

CVE-2026-48619

What is CVE-2026-48619?

A vulnerability in the Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, potentially resulting in an Out of Memory error on the client side. This issue impacts all currently supported versions of Node.js, specifically Node.js 22, 24, and 26, highlighting the importance of updating to mitigate the risk of service disruption.

References