DEBIAN-CVE-2026-123863: High severity debian/nodejs vulnerability

Published Nov 11, 2026

Updated

A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECKEQ(currentnghttp2memory, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).

Affected Software

3 affected components

debian/nodejs*

Event History

Nov 11, 2026

CVE Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Node.js HTTP/2 servers on affected 26.x releases since 26.9.0 and 24.x releases since 24.22.0 are exposed when reachable by untrusted clients. The issue applies to both TLS and cleartext HTTP/2.

Does exploitation require authentication or unusual server configuration?

No. An unauthenticated network client can trigger the failure against a default HTTP/2 server when its handler sends a response before the request body has finished, which is described as typical behavior.

What is the impact of a successful attack?

The attacker can cause the Node.js process to terminate by triggering a session-teardown assertion failure. The provided impact information indicates availability impact and integrity impact, with no confidentiality impact.

How can I determine whether a crash may be caused by this issue?

Look for Node.js HTTP/2 server process termination during session teardown associated with the CHECK_EQ(current_nghttp2_memory_, 0) assertion. The vulnerable condition involves a stream removed from the session stream set while still retaining nghttp2-allocated header buffers.

DEBIAN-CVE-2026-123863: High severity debian/nodejs vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or unusual server configuration?

What is the impact of a successful attack?

How can I determine whether a crash may be caused by this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or unusual server configuration?

What is the impact of a successful attack?

How can I determine whether a crash may be caused by this issue?