{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-123863","assignerOrgId":"ce714d77-add3-4f53-aff5-83d477b104bb","state":"PUBLISHED","assignerShortName":"openjs","dateReserved":"2026-11-06T16:12:44.473Z","datePublished":"2026-11-11T18:16:12.733Z","dateUpdated":"2026-11-11T18:16:12.733Z"},"containers":{"cna":{"providerMetadata":{"orgId":"ce714d77-add3-4f53-aff5-83d477b104bb","shortName":"openjs","dateUpdated":"2026-11-11T18:16:12.733Z"},"title":"Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown","descriptions":[{"lang":"en","value":"A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).","supportingMedia":[{"type":"text/markdown","base64":false,"value":"A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an `Http2Stream` that still holds `nghttp2`-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when `~Http2Session()` runs the memory accounting is nonzero and the `CHECK_EQ(current_nghttp2_memory_, 0)` assertion fails, terminating the process. The trigger needs only a default `http2` server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0)."}]}],"credits":[{"lang":"en","value":"Chris Rohlf in collaboration with Claude and Anthropic Research","type":"reporter"},{"lang":"en","value":"mcollina","type":"remediation developer"},{"lang":"en","value":"UlisesGascon","type":"remediation reviewer"},{"lang":"en","value":"pimterry","type":"remediation reviewer"},{"lang":"en","value":"ronag","type":"remediation reviewer"},{"lang":"en","value":"aduh95","type":"coordinator"}],"affected":[{"vendor":"nodejs","product":"node","defaultStatus":"unaffected","versions":[{"version":"24.0.0","status":"affected","lessThan":"24.22.3","versionType":"semver"},{"version":"25.0.0","status":"affected","lessThan":"26.13.1","versionType":"semver"}]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-617","description":"Reachable Assertion"}]}],"metrics":[{"format":"CVSS","cvssV3_0":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH"}}],"references":[{"url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases","tags":["vendor-advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html"}],"x_generator":{"engine":"nodejs-private/security-release publish-cves"}}}}