CVE-2026-123863

CVE Enrichment

CVSS: 8.2 HIGH
CISA KEV: Not listed

Description

A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).

Technical Details

CVSS Version: 3.0
CNA / NVD Source: ce714d77-add3-4f53-aff5-83d477b104bb
Published: 12-Nov-2026 02:17
Last Modified: 12-Nov-2026 02:17
CWE: CWE-617

CVSS Vector


            CVSS:3.0                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:N /
                            I:L /
                            A:H

CNA Products / Version Status

nodejs · node Source: CNA · ce714d77-add3-4f53-aff5-83d477b104bb
Default status: unaffected

24.0.0 ≤ version < 24.22.3 — affected (semver)
25.0.0 ≤ version < 26.13.1 — affected (semver)

References

Last enrichment sync: 12-Nov-2026 19:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

The crash flaw, CVE-2026-123863, needs only a default HTTP/2 server that replies before the request body has fully arrived. The Node.js project calls that behavior typical. The crash works over both TLS and cleartext Node.js Fixes HTTP/2 and HTTPS Flaws That Can Crash Servers or Leak Memory

CVE (2)

People (1)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.