A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade v8-12.4-develUpgrade nodejs-full-i18nUpgrade v8-13.6-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-libsUpgrade nodejs-devel | Jul 7, 2026 | Jul 6, 2026 |
| Alpine Linux | — | Upgrade nodejs | Jun 29, 2026 | Jun 26, 2026 |
| Amazon_linux_2023 | — | Upgrade v8-12.4-develUpgrade nodejs22-docsUpgrade nodejs24-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs24-docsUpgrade nodejs22-full-i18nUpgrade v8-13.6-develUpgrade nodejs22Upgrade nodejs22-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs22-libsUpgrade nodejs22-debugsourceUpgrade nodejs22-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-npmUpgrade nodejs24-libsUpgrade nodejs24-develUpgrade nodejs24-npmUpgrade nodejs22-libs-debuginfoUpgrade nodejs24 | Jul 8, 2026 | Jun 26, 2026 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs24-debugsourceUpgrade nodejs-nodemonUpgrade nodejs24-debuginfoUpgrade nodejs24No solution existsUpgrade v8-12.4-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-full-i18nUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs24-docsUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs-full-i18nUpgrade nodejs24-develUpgrade nodejs22-debuginfoUpgrade nodejs-npmUpgrade nodejs-libsUpgrade npmUpgrade nodejs24-npmUpgrade nodejs | Jul 7, 2026 | Jun 26, 2026 |
| Rocky_linux | — | Upgrade v8-12.4-develUpgrade nodejs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs24-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs-npmUpgrade nodejs24-debuginfoUpgrade nodejs24-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs24-debugsourceUpgrade nodejsUpgrade nodejs24Upgrade nodejs-libsUpgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejs22-debuginfo | Jul 10, 2026 | Jul 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub