nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade npmUpgrade nodejs-nodemonUpgrade libnghttp2Upgrade v8-13.6-develUpgrade nodejs-develUpgrade libnghttp2-develUpgrade nghttp2 | Apr 16, 2026 | Apr 8, 2026 |
| Alpine Linux | — | Upgrade nghttp2 | Apr 29, 2026 | Mar 18, 2026 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2-debuginfoUpgrade libnghttp2Upgrade nghttp2Upgrade libnghttp2-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-full-i18nUpgrade nodejs24-docsUpgrade nodejs24-libs-debuginfoUpgrade v8-12.4-develUpgrade nodejs24-debuginfoUpgrade v8-13.6-develUpgrade nodejs22-debuginfoUpgrade nghttp2Upgrade libnghttp2-develUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-develUpgrade nodejs22-npmUpgrade nodejs22Upgrade nghttp2-debuginfoUpgrade nodejs24-libsUpgrade nodejs24Upgrade nodejs22-docsUpgrade nodejs24-develUpgrade nghttp2-debugsourceUpgrade nodejs24-full-i18nUpgrade libnghttp2-debuginfoUpgrade nodejs24-npmUpgrade libnghttp2Upgrade nodejs22-debugsourceUpgrade nodejs22-libsUpgrade nodejs24-debugsource | Apr 14, 2026 | Mar 18, 2026 |
| Debian | — | Upgrade nghttp2 | May 14, 2026 | May 14, 2026 |
| Freebsd | — | Upgrade libnghttp2Upgrade nghttp2 | Apr 6, 2026 | Apr 5, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Jun 2, 2026 |
| Oracle_linux | — | Upgrade libnghttp2Upgrade nodejs-packagingUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade nodejs-npmUpgrade nodejs24-full-i18nUpgrade nodejs24-docsUpgrade nodejs-nodemonUpgrade nodejs24-develUpgrade nodejs24Upgrade nodejs24-libsUpgrade nodejsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs24-npmUpgrade libnghttp2-develUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nghttp2Upgrade nodejs-full-i18n | Apr 22, 2026 | Mar 18, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Aug 10, 2026 | Mar 18, 2026 |
| Redhat_linux | — | Upgrade nodejs24-debuginfoUpgrade npmUpgrade nodejs24-libsUpgrade nghttp2Upgrade libnghttp2Upgrade nodejs24-libs-debuginfoUpgrade nodejsUpgrade nodejs24-npmUpgrade nodejs24-docsUpgrade nodejs22-debugsourceUpgrade nodejs24-develUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade libnghttp2-develUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade v8-13.6-develUpgrade nodejs24Upgrade nodejs-full-i18nUpgrade nghttp2-debugsourceUpgrade libnghttp2-debuginfoUpgrade nghttp2-debuginfoUpgrade nodejs-packagingUpgrade nodejs24-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-nodemonUpgrade v8-12.4-develUpgrade nodejs-npmUpgrade nodejs24-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-docs | Apr 9, 2026 | Mar 18, 2026 |
| Rocky_linux | — | Upgrade nghttp2-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs22-debuginfoUpgrade v8-13.6-develUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade libnghttp2-debuginfoUpgrade nodejsUpgrade nodejs24Upgrade libnghttp2Upgrade nodejs24-debugsourceUpgrade nodejs-develUpgrade v8-12.4-develUpgrade nodejs24-libs-debuginfoUpgrade nghttp2-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs-npmUpgrade nodejs24-libsUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade npmUpgrade nodejs22-debugsourceUpgrade libnghttp2-develUpgrade nodejs-full-i18nUpgrade nghttp2Upgrade nodejs24-devel | Apr 13, 2026 | Apr 10, 2026 |
| Ubuntu | — | Upgrade nghttp2 (Ubuntu Pro)Upgrade libnghttp2-14Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2 | May 6, 2026 | May 5, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 18, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub