CVE-2026-123863: Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown
A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECKEQ(currentnghttp2memory, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.13.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.22.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.22.3Fixed in 26.13.1 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 22.23.5-r0 - Upgrade
Upgrade
alpine/nodejsto a version that resolves this vulnerability.Fixed in 24.22.3-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
Which deployments are exposed?
Node.js 26.x starting with 26.9.0 and Node.js 24.x starting with 24.22.0 are affected when they expose an HTTP/2 server. Both TLS-protected and cleartext HTTP/2 servers are vulnerable.
Does exploitation require authentication or unusual server configuration?
No. Any unauthenticated client can trigger the issue, and a default HTTP/2 server is affected when its handler sends a response before the request body has finished, which is described as typical.
What is the impact of a successful attack?
The attacker can cause a reachable assertion failure during HTTP/2 session teardown, terminating the Node.js process. This is a remote denial of service; the provided impact data identifies availability impact as high and integrity impact as low.
What can be done if an update cannot be applied immediately?
The provided information identifies exposure only through HTTP/2 servers. Disabling or avoiding externally reachable HTTP/2 service would remove the described attack path, if operationally feasible.
How can operators identify potentially affected services?
Identify Node.js services running 26.x from 26.9.0 onward or 24.x from 24.22.0 onward, then determine whether they accept HTTP/2 connections. Services whose HTTP/2 handlers respond before request bodies end meet the described trigger condition.