CVEvulnerability

CVE-2026-21714

5.3 MEDIUM Published 2026-03-30 Modified 2026-08-19 Official page ↗
Status
Analyzed
Published
2026-03-30
Last modified
2026-08-19
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-401

Description

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

Affected configurations

• nodejs node.js (<= 20.20.1) • nodejs node.js (>= 22.0.0 <= 22.22.1) • nodejs node.js (>= 24.0.0 <= 24.14.0) • nodejs node.js (>= 25.0.0 <= 25.8.1)

Related

Weakness · CWE (1)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness

References