CVE-2026-56846: HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.
This vulnerability affects Node.js 24.x and 22.x.
Other sources
A flaw in Node.js HTTP/2 handling can let retained header blocks evade maxSessionMemory limits and cause remote memory exhaustion.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2Fixed in 24.18.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.18.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-56846?
The severity of CVE-2026-56846 is rated as high with a score of 7.5.
How do I fix CVE-2026-56846?
To fix CVE-2026-56846, upgrade to a patched version of Node.js that addresses the HTTP/2 handling flaw.
What versions of Node.js are affected by CVE-2026-56846?
CVE-2026-56846 affects Node.js versions 24.x and 22.x.
What impact does CVE-2026-56846 have on an application?
CVE-2026-56846 can cause remote memory exhaustion due to HTTP/2 retained header blocks evading maxSessionMemory.
Is there a workaround for CVE-2026-56846?
Currently, there are no known workarounds for CVE-2026-56846, and users are advised to update Node.js.