CVE-2026-56846

Overview

Node.js is a JavaScript runtime built on Chrome’s V8 JavaScript engine. It offers an event-driven, non-blocking I/O model that makes it lightweight and efficient, and is widely used in server-side applications.

A denial of service vulnerability (CVE-2026-56846) has been identified in the Node.js HTTP/2 implementation, where retained header blocks can evade the per-session maxSessionMemory limit. A remote peer can therefore drive an HTTP/2 session past the memory ceiling that is meant to bound it, leading to memory exhaustion on the affected server.

Per MITRE, CWE-400, Uncontrolled Resource Consumption, describes a product that "does not properly control the allocation and maintenance of a limited resource."

The upstream advisory lists the actively supported 24.x and 22.x release lines as affected. The End-of-Life 12.x, 14.x, 16.x, 18.x, and 20.x lines are affected as well and received a post-EOL security fix under Node.js NES. The 26.x line is not listed as affected upstream and received no fix in this release.

Details

Module Info

• Product: Node.js
• Affected packages: Node.js
• Affected versions:
  • <=24.18.0
  • <=22.23.1
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://github.com/nodejs/node/releases
• Package manager: npm
• Fixed in: Node.js NES v12.22.20, v14.21.13, v16.20.14, v18.20.19, and v20.20.4. The 14.x, 16.x, 18.x, and 20.x NES releases shipped on August 3, 2026; the 12.x NES release shipped on August 11, 2026.

Vulnerability Info

This High-severity vulnerability is found in the HTTP/2 implementation of the Node.js runtime, in the 24.x and 22.x release lines up to and including v24.18.0 and v22.23.1, and in the End-of-Life lines that share that code.

The node:http2 module lets a server bound how much memory any single HTTP/2 session may consume, through the maxSessionMemory option. The limit is the mechanism that keeps one peer from consuming server memory without end: once a session’s accounted memory use reaches the ceiling, new streams on that session are rejected rather than served.

Header blocks that the session retains are not counted against that ceiling. The accounting therefore understates what the session is actually holding, and the limit does not fire when it should. A remote peer that repeatedly causes header blocks to be retained can grow a session’s real memory footprint well past the configured maxSessionMemory value while the session continues to accept new work.

The result is remote memory exhaustion against an HTTP/2 server, reachable over the network with no privileges and no user interaction. That matches the CVSS vector upstream assigned: high availability impact with no confidentiality or integrity impact (CVSS v3.0 7.5). The issue affects availability only; it does not expose data or allow modification of it.

Mitigation

The Node.js 12.x, 14.x, 16.x, 18.x, and 20.x release lines are End-of-Life and will not receive an upstream update to address this issue. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Update to a patched, actively supported Node.js release: v22.23.2 or v24.18.1.
• Migrate affected applications away from the End-of-Life Node.js release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support (Node.js NES).

Credits

• leduckhuong (reporter)
• mcollina (remediation developer)