5.3Media

CVE-2026-21714

nodejs node Publicada: 2026-03-30 22:07 (hace 7 meses)

Descripción

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

Debilidad (CWE): CWE-401

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
nodejs	node	20.20.1 – ≤ 20.20.1, 22.22.1 – ≤ 22.22.1, 24.14.0 – ≤ 24.14.0, 25.8.1 – ≤ 25.8.1
nodejs	node.js	≤ 20.20.1

Referencias y parches

https://nodejs.org/en/blog/vulnerability/march-2026-security-releases Vendor Advisory

Coincidencias CPE (NVD) (4)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≤ 20.20.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 22.0.0 ≤ 22.22.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 24.0.0 ≤ 24.14.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 25.0.0 ≤ 25.8.1

Puntuación CVSS

5.3Media

Fuente: hackerone · CVSS 3.0

Vector de ataque: Red
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Ninguno
Integridad: Ninguno
Disponibilidad: Bajo

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Todas las puntuaciones (2)

cna	CVSS 3.0	5.3Media
support@hackerone.com	CVSS 3.0	5.3Media

EPSS (probabilidad de explotación en 30 días)

0.43%

superior al 38 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: yes
Impacto técnico: partial

Cronología

ID reservado2026-01-04
Publicada2026-03-30 22:07
Llegó a IP-DB2026-10-24 23:49
Última actualización2026-08-19 16:35

Asignada por (CNA): hackerone
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Node.js

7.5Alta

CVE-2026-126051 hace 4 horas

Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks

nodejs node

A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacker to terminate the server process. When a TLS server uses any of the SNICallback, OCSPRequest, newSession, or resumeSession hooks, or server…

5.9Media

CVE-2026-123875 hace 4 horas

Node.js is vulnerable to an HTTP/2 denial of service via a NULL pointer dereference when a respondWithFile() download is cancelled

nodejs node

A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and cleartext, by cancelling file downloads. When the server serves a file with stream.respondWithFile() or stream.respondWithFD() and the client cance…

7.5Alta

CVE-2026-123874 hace 4 horas

Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write

nodejs node

A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, when the server serves files with respondWithFile() or respondWithFD(). A client can make the server free an Http2Stream while a write reques…

8.1Alta

CVE-2026-123872 hace 4 horas

Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change

nodejs node

A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example s…

6.8Media

CVE-2026-123877 hace 4 horas

Node.js is vulnerable to a certificate validation bypass in https.Agent via cross-policy TLS session reuse

nodejs node

A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be reused by a later request with a stricter policy. https.Agent.prototype.getName() assigns the same Agent and session-cache key to a request t…

6.2Media

CVE-2026-123871 hace 4 horas

Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages

nodejs node

Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed fou…