HIGHFixed upstream

CVE-2026-56846

Node.js: retained HTTP/2 headers bypass maxSessionMemory

Technology

Node.js

CVSS Score

7.5 / 10.0

Affected Versions

Node.js 22 and 24 before the July 2026 releases

Upstream Fix

22.23.2; 24.18.1

Published

August 4, 2026

OSSeva Coverage

Fixed upstream

Description

Retained HTTP/2 header blocks could evade maxSessionMemory limits, allowing remote memory exhaustion. Rated High by Node.js. Fixed in the July 2026 security releases: 22.23.2 and 24.18.1.

Upstream record: NVD · CVE.org

Is your Node.js deployment affected?

If you're running Node.js 22 and 24 before the July 2026 releases, you need this patch. Book a discovery call to get covered.

Book a discovery call View Node.js coverage →