CVE-2026-48937: Medium severity OpenJS Foundation Node.js vulnerability
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable HTTP/2 support in affected Node.js servers (and in fronting reverse proxies/load balancers) until an official fix is available to prevent servers from accepting data after sending GOAWAY.
Node.js HTTP/2 server API HTTP/2 support = disabled - Compensating control
Restrict access to services that accept HTTP/2 connections using network controls (firewall, ACLs, WAF) so only trusted IPs or networks can reach the Node.js HTTP/2 endpoints until a fix is applied.
- Operational
Monitor Node.js security advisories for a published fix for this HTTP/2 GOAWAY issue and apply the vendor patch as soon as it is available; after applying the fix, restart Node.js instances and verify HTTP/2 behavior in testing before re-enabling exposure.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48937?
The severity of CVE-2026-48937 is rated as medium with a score of 5.3.
Which versions of Node.js are affected by CVE-2026-48937?
CVE-2026-48937 affects Node.js version 22 and version 24.
What is the impact of CVE-2026-48937?
CVE-2026-48937 allows servers to continue accepting data after a `GOAWAY` frame has been sent.
How do I fix CVE-2026-48937?
To mitigate CVE-2026-48937, upgrade to a patched version of Node.js provided by OpenJS Foundation.
Does CVE-2026-48937 affect the confidentiality of data?
CVE-2026-48937 does not impact the confidentiality of data as it primarily affects data flow during connections.