Memory Exhaustion Vulnerability in Node.js HTTP/2 Handling by Node.js

CVE-2026-56846

What is CVE-2026-56846?

A vulnerability in the HTTP/2 handling of Node.js allows for the potential evasion of maximum session memory limits via retained header blocks. This could be exploited to trigger remote memory exhaustion, negatively impacting the performance and stability of affected Node.js applications. The flaw affects versions 24.x and 22.x, highlighting the necessity for users to update their systems in light of this significant risk.

References