CVE-2026-48937

Overview

Node.js is a JavaScript runtime built on Chrome's V8 JavaScript engine. It uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, and it is widely used for web applications and server-side development. Node.js's built-in http2 module is not a from-scratch HTTP/2 implementation: it is built on top of nghttp2, a C library that Node.js vendors and statically links into the published node binary.

A resource-exhaustion vulnerability (CVE-2026-48937) has been identified in Node.js's HTTP/2 server integration with nghttp2: a server could keep accepting and processing data on an HTTP/2 session even after it had already sent a GOAWAY frame in response to an invalid-protocol error, instead of tearing the session down.

This issue affects the Node.js 22 and 24 release lines; Node.js 26 is not affected.

Details

Module Info

• Product: Node.js
• Affected packages: Node.js itself, the built-in http2 module's integration with the bundled nghttp2 library (native runtime code, not a separately published npm package)
• Affected versions: <=22.22.3; <=24.16.0
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable. Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package.
• Fixed in: Node.js NES v12.22.19, v14.21.12, v16.20.13, and v18.20.18 (June 25, 2026), and v20.20.4 (August 3, 2026). Fixed upstream in Node.js 22.23.0 and 24.17.0 (June 18, 2026).

Vulnerability Info

This Medium-severity vulnerability (CVSS v3.0 5.3) is found in Node.js's built-in http2 module, in Node.js 22.x and 24.x builds prior to the fixed versions above (and, per HeroDevs NES, the equivalent EOL 12.x/14.x/16.x/18.x builds released June 25, 2026, plus the EOL 20.x line as of NES v20.20.4 on August 3, 2026).

Sending an HTTP/2 GOAWAY frame is meant to tell the peer that the session is shutting down, that no new streams should be opened, and that the server will stop processing further data on that session.

Node.js's HTTP/2 server integration with its bundled nghttp2 library did not fully stop processing incoming data after emitting a GOAWAY frame along certain invalid-protocol error paths. The session kept accepting and processing attacker-supplied data instead of tearing down, an uncontrolled resource consumption issue (CWE-400) that lets a client keep a nominally-closing session alive and consuming server resources. The fix corrects the session-teardown handling in Node.js's nghttp2 bindings.

Note: Node.js 26.x is not affected by this CVE per the upstream advisory.

Mitigation

This CVE was disclosed in Node.js's coordinated June 18, 2026 security release, and the upstream advisory scopes it to the currently-supported Node.js 22.x and 24.x lines only (Node.js 26.x is not affected):

• Users on Node.js 22.x should upgrade to 22.23.0 or later.
• Users on Node.js 24.x should upgrade to 24.17.0 or later.

HeroDevs' Node.js NES release notes additionally list this CVE as addressed for five End-of-Life lines: Node.js NES 12.22.19, 14.21.12, 16.20.13, and 18.20.18, all released June 25, 2026, and Node.js NES 20.20.4, released August 3, 2026. Node.js 12.x reached End-of-Life on April 30, 2022, Node.js 14.x on April 30, 2023, Node.js 16.x on September 11, 2023, Node.js 18.x on April 30, 2025, and Node.js 20.x on April 30, 2026. For more information see previous releases.

Users of the affected EOL components should apply one of the following mitigations:

• Upgrade to a currently supported Node.js line (22.x or 24.x).
• Migrate affected applications away from the End-of-Life Node.js 12.x, 14.x, 16.x, 18.x, or 20.x release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• Tim Perry (reporter)