CVE-2026-48937: HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame.
This vulnerability affects two supported release lines: Node.js 22 and Node.js 24.
Other sources
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0Fixed in 24.17.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.17.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-48937?
The severity of CVE-2026-48937 is rated as medium with a score of 5.3.
Which versions of Node.js are affected by CVE-2026-48937?
CVE-2026-48937 affects Node.js version 22 and version 24.
What is the impact of CVE-2026-48937?
CVE-2026-48937 allows servers to continue accepting data after a `GOAWAY` frame has been sent.
How do I fix CVE-2026-48937?
To mitigate CVE-2026-48937, upgrade to a patched version of Node.js provided by OpenJS Foundation.
Does CVE-2026-48937 affect the confidentiality of data?
CVE-2026-48937 does not impact the confidentiality of data as it primarily affects data flow during connections.