Node.js: HTTP/2 memory exhaustion denial of service via unaccounted DATA frames
Summary
Node.js HTTP/2 servers keep inbound DATA frames queued on undrained streams without charging them to the session memory budget. An unauthenticated remote client can send many one-byte DATA frames on a single stream and make the server retain hundreds of megabytes, which can lead to a denial of service. The maxSessionMemory limit does not cap this growth or block new streams, so any reachable HTTP/2 listener is exposed.
Affected
- Node.js 24.x from 24.0.0 before 24.22.3
- Node.js 25.x and 26.x before 26.13.1 (25.x is end of life)
- Node.js 22.x before 22.23.5: fix listed in the release notes but not in the CVE record; treat as affected until the vendor confirms
Fixed in
- Node.js 26.x: 26.13.1
- Node.js 24.x: 24.22.3
- Node.js 22.x: 22.23.5
- Node.js 25.x and older end-of-life lines: no fix, migrate to a supported release line
Workaround
Unknown. No vendor workaround was found, and tuning maxSessionMemory is not a mitigation. Interim measure (not from a source): place a reverse proxy that terminates HTTP/2 in front of Node.js, or restrict the HTTP/2 listener to trusted networks, and verify that it actually limits this behaviour.
Exploitation
- No public proof of concept or exploit found at the time of writing.
- Not listed as known to be exploited (OffSeq) and not in CISA KEV (Strix).
- CVSS 5.9 (MEDIUM), vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
Our recommendation
- Inventory all Node.js runtimes and container images and identify HTTP/2 listeners.
- Upgrade to 26.13.1, 24.22.3 or 22.23.5 for the matching release line and restart the services.
- Migrate systems on 25.x or other end-of-life lines to a supported release.
- If patching is delayed, restrict exposure of HTTP/2 listeners as described under workaround.
- Recheck the vendor advisory and NVD once the analysis is published.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-123868 www.cve.org
- OpenJS CNA Security Advisories cna.openjsf.org
- Node.js security releases, 11 November 2026 nodejs.org
- Node.js 26.13.1 release nodejs.org
- Node.js 22.23.5 release notes github.com
- OffSeq threat radar entry radar.offseq.com
- Strix CVE entry CVE-2026-123868 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:43.
Original description (NVD)
An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.