CVE-2026-123863
Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown
Description
A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
INFO
Published Date :
Nov. 11, 2026, 6:16 p.m.
Last Modified :
Nov. 11, 2026, 6:16 p.m.
Remotely Exploit :
Yes !
Source :
openjs
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.0 | HIGH | ce714d77-add3-4f53-aff5-83d477b104bb | ||||
| CVSS 3.0 | HIGH | MITRE-CVE |
Solution
- Update Node.js to version 26.9.0 or later.
- Update Node.js to version 24.22.0 or later.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-123863 vulnerability anywhere in the article.