UBUNTU-CVE-2026-123863: Medium severity ubuntu/nodejs vulnerability
A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECKEQ(currentnghttp2memory, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Node.js HTTP/2 servers in the affected 26.x releases since 26.9.0 and 24.x releases since 24.22.0 are affected. Both TLS and cleartext HTTP/2 servers are in scope.
Does exploitation require authentication or a non-default server setup?
No authentication is required. The trigger needs only a default HTTP/2 server whose handler sends a response before the request body has finished, which is described as typical.
What is the operational impact of a successful attempt?
A remote client can cause the Node.js process to terminate when HTTP/2 session teardown reaches the failing memory-accounting assertion. This is a server availability impact.
How can an affected service fail?
The process aborts on the CHECK_EQ(current_nghttp2_memory_, 0) assertion during Http2Session destruction. The condition occurs when a stream with nghttp2-allocated header buffers outlives its session after being removed from the session stream set without being detached.