CVE-2026-123863

A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).

• CWE-617

• https://cna.openjsf.org/security-advisories.html
• https://nodejs.org/en/blog/vulnerability/november-2026-security-releases

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123858In JetBrains PhpStorm before 2026.3 project files could be a…4.4
• CVE-2026-123859When identifier escaping is disabled through a non-default c…8.1
• CVE-2026-12386Improper null termination vulnerability in TUBITAK BILGEM So…3.9
• CVE-2026-123860Improper Neutralization of Script-Related HTML Tags in a Web…5.3
• CVE-2026-123861Authorization Bypass Through User-Controlled Key vulnerabili…5.3
• CVE-2026-123862An uncatchable exception in the Node.js zlib streaming API l…2.9
• CVE-2026-123864A re-entrancy flaw in Node.js HTTPS lets an unauthenticated …8.1
• CVE-2026-123865An unauthenticated HTTP/2 client can permanently leak Node.j…7.5
• CVE-2026-123866A use-after-free in Node.js HTTP/2 stream teardown can leak …7.5
• CVE-2026-123867A per-host mutual-TLS authorization bypass in Node.js lets a…4.2
• CVE-2026-123868An unauthenticated HTTP/2 client can exhaust Node.js server …5.9
• CVE-2026-12387Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel D…5.1