Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-04T00:49:58 nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-400

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service (DoS) for the affected system.

This Important flaw in Node.js HTTP/2 handling allows a remote attacker to bypass `maxSessionMemory` limits by sending specially crafted header blocks. This can lead to memory exhaustion and a denial of service for Node.js applications configured to use HTTP/2, without requiring authentication or user interaction. To mitigate this issue, restrict network access to Node.js applications utilizing HTTP/2 to trusted clients only, by implementing firewall rules or network access controls. If HTTP/2 functionality is not essential for the application, consider disabling it in the Node.js configuration to prevent exploitation. Always ensure that any service restarts or reloads are performed carefully to avoid service disruption. Red Hat Hardened Images 2026-07-29T00:00:00Z RHSA-2026:48305 nodejs22-main-22.23.2-2.3.hum1 Red Hat Hardened Images 2026-07-30T00:00:00Z RHSA-2026:48537 nodejs24-main-24.18.1-0.1.hum1 Red Hat Enterprise Linux 10 Affected nodejs22 Red Hat Enterprise Linux 10 Affected nodejs24 Red Hat Enterprise Linux 8 Affected nodejs:22/nodejs Red Hat Enterprise Linux 8 Affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Affected nodejs:22/nodejs Red Hat Enterprise Linux 9 Affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Affected nodejs:26/nodejs Red Hat Hardened Images Not affected nodejs20 Red Hat Hardened Images Not affected nodejs25 Red Hat Hardened Images Not affected nodejs26 https://www.cve.org/CVERecord?id=CVE-2026-56846 https://nvd.nist.gov/vuln/detail/CVE-2026-56846 https://nodejs.org/en/blog/vulnerability/july-2026-security-releases