Node.js HTTP/2 Server API Vulnerability in Node.js Products by Node.js Foundation

CVE-2026-48937

What is CVE-2026-48937?

A significant flaw in the Node.js HTTP/2 server API allows servers to continue accepting data even after a GOAWAY frame has been sent. This issue pertains to both supported release lines of Node.js: versions 22 and 24. As a result, affected servers may become susceptible to potential overflow conditions, which could lead to excessive resource consumption or security misconfigurations, thereby increasing the risk of attacks.

References