UBUNTU-CVE-2026-123868: Medium severity ubuntu/nodejs vulnerability
An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to currentsessionmemory: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Node.js 26.x and 24.x deployments that accept HTTP/2 connections are affected. An unauthenticated client can trigger the memory growth, so exposure includes services reachable by untrusted HTTP/2 clients.
What does an attacker need to do to exhaust memory?
The attacker needs an HTTP/2 connection and an inbound stream that the server does not drain. By sending many one-byte DATA frames up to the stream receive window, the attacker causes JavaScript Buffer views to accumulate in the stream's readable queue.
Does maxSessionMemory protect affected servers?
No. Queued inbound DATA is not charged to the session memory counter, so maxSessionMemory does not bound this growth and does not prevent new stream admission based on the unaccounted queue.
How can I tell whether a service is being affected?
Look for unexpectedly growing Node.js process memory associated with HTTP/2 connections whose inbound streams are not being drained. The vulnerable behavior involves many small inbound DATA frames accumulating as Buffer views in a stream readable queue.