CVE-2026-48619

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development.

Node.js's built-in HTTP/2 client does not enforce a limit on the number of ORIGIN frames a remote HTTP/2 server may send on a single connection (CVE-2026-48619). The HTTP/2 client retains state for each ORIGIN frame it receives, so a malicious or compromised server can send an effectively unlimited stream of ORIGIN frames to a connected Node.js client, driving unbounded memory growth on the client until the process runs out of memory and crashes. This is an Uncontrolled Resource Consumption (CWE-400) issue resulting in a Denial of Service.

This issue affects the Node.js 22, 24, and 26 release lines.

Details

Module Info

• Product: Node.js
• Affected packages: node (the vulnerability is in Node.js's own built-in http2 module, not a bundled third-party dependency)
• Affected versions: <=22.22.3; <=24.16.0; <=26.3.0
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Official Node.js distributions (not published to a package registry)
• Fixed in: Node.js NES v12.22.19, v14.21.12, v16.20.13, v18.20.18, and v20.20.3 (all June 25, 2026). Fixed upstream in Node.js 22.23.0, 24.17.0, and 26.3.1 (June 18, 2026).

Vulnerability Info

This Medium-severity vulnerability is found in Node.js's built-in http2 module's client-side connection handling.

The HTTP/2 protocol's ORIGIN frame lets a server tell a client which additional origins it is authoritative for on the same connection (used for connection coalescing). A well-behaved server sends a small, bounded number of these frames; Node.js's client is expected to track the origin set they describe without that tracking becoming a liability.

Because the client places no cap on how many ORIGIN frames it will accept and record, a server (which need not be trusted, since the client initiates the HTTP/2 handshake to it) can send an unbounded stream of ORIGIN frames. Each frame Node.js processes consumes additional memory that is never released for the life of the connection, so a sufficiently long-lived connection to a malicious server can grow the client process's memory usage without bound, eventually triggering an Out-of-Memory condition and crashing the process.

Note: this is a client-side vulnerability. The attacker acts as (or compromises) the HTTP/2 server a Node.js application connects to, not as a client connecting to a Node.js HTTP/2 server.

Mitigation

Officially, this issue affects the currently supported Node.js 22, 24, and 26 release lines, all of which have patched releases available (22.23.0, 24.17.0, 26.3.1).

Node.js 12 reached End-of-Life on April 30, 2022; Node.js 14 reached End-of-Life on April 30, 2023; Node.js 16 reached End-of-Life on September 11, 2023; and Node.js 18 reached End-of-Life on April 30, 2025. For more information see previous releases.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a supported Node.js release (22.23.0, 24.17.0, 26.3.1, or later).
• Migrate affected applications away from the End-of-Life Node.js release line(s).
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• kingsd (reporter)
• Matteo Collina (remediation developer)