UBUNTU-CVE-2026-123828: Buffer Overflow
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/nodehttp2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using affected Node.js 26.x or 24.x are exposed when they pass attacker-controlled data, such as an HTTP/2 request’s :authority header, to Http2Session.altsvc().
What must an attacker do to trigger the vulnerability?
An unauthenticated remote attacker needs to send a request with a long but syntactically valid :authority value that the application supplies to Http2Session.altsvc(). A single such request can trigger the one-byte out-of-bounds write.
What is the likely operational impact of exploitation?
The out-of-bounds write corrupts process memory and can abort the Node.js process, creating a denial-of-service condition. The issue is also described as a remote heap-corruption primitive.