ALPINE-CVE-2026-123828: Buffer Overflow
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/nodehttp2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.5-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using affected Node.js 26.x or 24.x releases are exposed when they pass attacker-controlled input, such as an HTTP/2 request's :authority header, to Http2Session.altsvc().
What does an attacker need to exploit it?
The attacker does not need authentication or user interaction. They need to send a request with a long, syntactically valid :authority value that the application subsequently supplies to Http2Session.altsvc().
What is the likely impact of a successful attempt?
The out-of-bounds null-terminator write corrupts heap memory and can abort the Node.js process, causing denial of service. The issue is also described as a remote heap-corruption primitive.
How can I determine whether an application is affected?
Check whether it runs Node.js 24.x or 26.x and whether its HTTP/2 code calls Http2Session.altsvc() with values derived from incoming requests or other untrusted sources, particularly the :authority header.