UBUNTU-CVE-2026-123865: Medium severity ubuntu/nodejs vulnerability
An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for example an oversized frame header, while the session is already shutting down, nghttp2 tears the session down internally but Node.js never notices, leaving a dangling session: the socket stays in CLOSEWAIT and all of Node.js's HTTP/2 state for that connection is held in memory indefinitely, with no further cost to the attacker. The attacker can start the shutdown remotely by sending GOAWAY(NOERROR), so it is reliable against default HTTP/2 servers. It is an incomplete-fix case of CVE-2026-48937: that fix detected nghttp2 internal terminations by watching for GOAWAY sent while not shutting down, but missed terminations that arrive while the session is already shutting down. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Node.js HTTP/2 servers using affected 26.x, 24.x, or 22.x releases are exposed. The issue is reliable against default HTTP/2 server configurations.
What does an attacker need to exploit it?
An attacker only needs to act as an unauthenticated HTTP/2 client. They can initiate shutdown with GOAWAY(NO_ERROR) and then trigger a protocol error, such as an oversized frame header, while shutdown is in progress.
What is the operational impact of a successful attack?
Each affected connection can leave its socket in CLOSE_WAIT while retaining Node.js HTTP/2 state and a file descriptor indefinitely. Repeated connections can permanently consume server memory and file descriptors without further attacker activity.
How can I recognize potentially affected connections?
Look for HTTP/2 connections that remain in CLOSE_WAIT and continue to retain associated Node.js HTTP/2 session state. The condition occurs when a protocol error is triggered during connection shutdown.