A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.
CVSS Details
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade npmUpgrade v8-13.6-devel | Apr 16, 2026 | Apr 9, 2026 |
| Alpine Linux | — | Upgrade nodejs | Mar 31, 2026 | Mar 30, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-full-i18nUpgrade v8-13.6-develUpgrade nodejs22-full-i18nUpgrade v8-12.4-develUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-npmUpgrade nodejs24-debuginfoUpgrade nodejs20Upgrade nodejs20-debuginfoUpgrade nodejs20-npmUpgrade nodejs20-develUpgrade nodejs22-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-npmUpgrade nodejs22-develUpgrade nodejs20-debugsourceUpgrade nodejs20-libs-debuginfoUpgrade v8-11.3-develUpgrade nodejs22Upgrade nodejs24Upgrade nodejs24-debugsourceUpgrade nodejs22-libsUpgrade nodejs24-libsUpgrade nodejs20-libsUpgrade nodejs24-develUpgrade nodejs24-docsUpgrade nodejs20-full-i18nUpgrade nodejs22-debugsourceUpgrade nodejs20-docsUpgrade nodejs22-docs | Apr 14, 2026 | Mar 30, 2026 |
| Debian | — | Upgrade nodejs | May 17, 2026 | May 17, 2026 |
| Oracle_linux | — | Upgrade nodejs24-npmUpgrade nodejs24Upgrade nodejs-packaging-bundlerUpgrade nodejs24-full-i18nUpgrade nodejs24-develUpgrade nodejs-docsUpgrade v8-13.6-develUpgrade nodejs24-libsUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs24-docsUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade npmUpgrade nodejs-packaging | Apr 22, 2026 | Mar 30, 2026 |
| Redhat_linux | — | Upgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs24-debuginfoUpgrade nodejs24-npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs-libsUpgrade nodejs24-docsUpgrade nodejs24-full-i18nUpgrade nodejs-full-i18nUpgrade nodejs24Upgrade v8-13.6-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs24-debugsourceUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejsNo solution exists | Apr 13, 2026 | Mar 30, 2026 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs24Upgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejs24-develUpgrade nodejs-develUpgrade nodejs24-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs24-libs | Apr 13, 2026 | Apr 10, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 30, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub