CVE-2026-123868

An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream is charged to no session budget. Each inbound DATA frame creates one JavaScript Buffer view in the receiving stream's readable queue, but nothing charges that queue to current_session_memory_: the socket read buffer is accounted only during parsing and released immediately, so whatever stays queued is accounted to nothing. A peer that fills a stream's receive window with one-byte DATA frames pays about 10 wire bytes per frame while the server retains about 114 bytes per frame, so a single stream on one connection can retain hundreds of megabytes from tens of megabytes sent. maxSessionMemory neither bounds the growth nor refuses new streams, because Http2Session::CanAddStream gates admission on the same counter that never sees the queue. This vulnerability affects Node.js 26.x and 24.x.

• CWE-400

• https://cna.openjsf.org/security-advisories.html
• https://nodejs.org/en/blog/vulnerability/november-2026-security-releases

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123862An uncatchable exception in the Node.js zlib streaming API l…2.9
• CVE-2026-123863A reachable assertion in Node.js HTTP/2 session teardown let…8.2
• CVE-2026-123864A re-entrancy flaw in Node.js HTTPS lets an unauthenticated …8.1
• CVE-2026-123865An unauthenticated HTTP/2 client can permanently leak Node.j…7.5
• CVE-2026-123866A use-after-free in Node.js HTTP/2 stream teardown can leak …7.5
• CVE-2026-123867A per-host mutual-TLS authorization bypass in Node.js lets a…4.2
• CVE-2026-12387Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel D…5.1
• CVE-2026-123870The otterdog webapp evaluates a format-string built from the…9.5
• CVE-2026-123871Node.js discloses proxy credentials in ERR_PROXY_INVALID_CON…6.2
• CVE-2026-123872A client certificate authentication bypass in Node.js TLS le…8.1
• CVE-2026-123874A use-after-free in Node.js HTTP/2 lets an unauthenticated c…7.5
• CVE-2026-123875A NULL pointer dereference in Node.js HTTP/2 lets an unauthe…5.9