7.5High

CVE-2026-56846

nodejs node Published: 2026-08-04 03:49 (3 months ago)

Description

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

Weakness (CWE): CWE-400

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
nodejs	node	24.18.0 – ≤ 24.18.0, 22.23.1 – ≤ 22.23.1

References and patches

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases

CVSS score

7.5High

Source: hackerone · CVSS 3.0

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

All scores (2)

cna	CVSS 3.0	7.5High
support@hackerone.com	CVSS 3.0	7.5High

EPSS (chance of exploitation in 30 days)

0.56%

higher than 47% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: partial

Timeline

ID reserved2026-06-23
Published2026-08-04 03:49
Reached IP-DB2026-10-24 23:41
Last updated2026-10-24 02:10

Assigned by (CNA): hackerone
NVD status: Awaiting Analysis

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Node.js

7.5High

CVE-2026-126051 2 days ago

Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks

nodejs node

A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server…

5.9Medium

CVE-2026-123875 2 days ago

Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled

nodejs node

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cance…

7.5High

CVE-2026-123874 2 days ago

Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write

nodejs node

A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write reques…

8.1High

CVE-2026-123872 2 days ago

Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change

nodejs node

A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example s…

6.8Medium

CVE-2026-123877 2 days ago

Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse

nodejs node

A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request t…

6.2Medium

CVE-2026-123871 2 days ago

Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages

nodejs node

Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed fou…