ALPINE-CVE-2026-123868: Medium severity alpine/nodejs vulnerability
An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to currentsessionmemory: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.5-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Node.js 26.x and 24.x servers that accept HTTP/2 connections are affected. An unauthenticated remote client can trigger the condition over the network.
What does an attacker need to do to cause impact?
The attacker needs to send many small HTTP/2 DATA frames on a stream that the application does not drain. Filling the stream receive window with one-byte DATA frames can cause the server to retain substantially more memory than the attacker sends.
Does maxSessionMemory limit this memory growth?
No. Queued inbound DATA in the stream readable queue is not charged to the session memory counter, so maxSessionMemory neither bounds the growth nor prevents new stream admission in this scenario.
What is the likely operational impact?
Memory consumption can grow until the Node.js server is exhausted, resulting in a denial of service. A single stream on one connection can retain hundreds of megabytes while the peer sends only tens of megabytes.