Node.js: HTTP/2 memory and file-descriptor leak via protocol error during shutdown
Summary
An unauthenticated remote attacker can exhaust memory and file descriptors of a Node.js server that has HTTP/2 enabled. The attacker triggers a protocol error while the HTTP/2 session is already shutting down, for example after sending GOAWAY(NO_ERROR). Node.js does not notice the internal session teardown, so the socket stays in CLOSE_WAIT and the session state is held in memory until the process is restarted. This is an incomplete fix of CVE-2026-48937.
Affected
- Node.js 22.x before 22.23.5
- Node.js 24.x before 24.22.3
- Node.js 26.x before 26.13.1
- End-of-life Node.js versions are affected as well (CNA record: 0.0.0 to < 22.23.5, 23.0.0 to < 24.22.3, 25.0.0 to < 26.13.1)
Fixed in
- Node.js 22.23.5
- Node.js 24.22.3
- Node.js 26.13.1
- Backports to other release lines: Unknown.
Workaround
Unknown. No vendor workaround was found. Placing a reverse proxy that terminates HTTP/2 in front of Node.js is a possible mitigation, but it has not been verified against the vendor advisory.
Exploitation
- No confirmed exploitation known.
- No public proof of concept found.
- The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so the attack is reliable against default HTTP/2 servers.
Our recommendation
- Upgrade Node.js to the fixed releases 22.23.5, 24.22.3 or 26.13.1 and restart the services.
- Migrate any end-of-life Node.js deployment to a supported release, because no fix is provided for it.
- Prioritise internet-facing Node.js services with HTTP/2 enabled.
- Monitor for growing numbers of sockets in CLOSE_WAIT and for rising memory and file-descriptor use.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenJS CNA Security Advisories cna.openjsf.org
- Node.js Security Releases, 11 November 2026 nodejs.org
- CVE-2026-123865 (threatint) cve.threatint.com
- CVE-2026-123865 (VulDB) vuldb.com
- CVE-2026-123865 (OffSeq Radar) radar.offseq.com
- Node.js HTTP/2 and TLS vulnerabilities, November 2026 (SecurityOnline) securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:35.
Original description (NVD)
An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSE_WAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NO_ERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.