ALPINE-CVE-2026-123863: High severity alpine/nodejs vulnerability
A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECKEQ(currentnghttp2memory, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.5-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0
Event History
Frequently Asked Questions
Which deployments are exposed?
Node.js 26.x since 26.9.0 and 24.x since 24.22.0 are affected. A default HTTP/2 server is vulnerable when its handler sends a response before the request body has finished, which is described as typical behavior.
Does exploitation require authentication, user interaction, or TLS?
No. Any unauthenticated client can trigger the failure without user interaction, and the issue is reachable over both TLS and cleartext HTTP/2.
What is the practical impact of a successful attack?
The process terminates when the HTTP/2 session teardown assertion fails. This creates a remote denial-of-service condition; the provided severity vector also indicates high availability impact and low integrity impact.