CVE-2026-21714: Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion
A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOWUPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.2Fixed in 22.22.2Fixed in 24.14.1Fixed in 25.8.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.22.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.14.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.8.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-21714?
CVE-2026-21714 has been rated as a moderate severity vulnerability due to the potential for resource exhaustion.
How do I fix CVE-2026-21714?
To fix CVE-2026-21714, you should upgrade your Node.js version to the latest secure release.
Who is affected by CVE-2026-21714?
CVE-2026-21714 affects Node.js versions 20, 22, 24, and 25.
What type of vulnerability is CVE-2026-21714?
CVE-2026-21714 is a memory leak vulnerability in Node.js HTTP/2 servers.
What are the consequences of CVE-2026-21714?
The consequences of CVE-2026-21714 include potential performance degradation and denial of service due to unfreed memory.