nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nghttp2Upgrade v8-13.6-develUpgrade libnghttp2-develUpgrade v8-12.4-develUpgrade libnghttp2Upgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-libs | Apr 16, 2026 | Apr 8, 2026 |
| Alpine Linux | — | Upgrade nghttp2 | Apr 29, 2026 | Mar 18, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libnghttp2Upgrade nghttp2-debuginfoUpgrade libnghttp2-develUpgrade nghttp2 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24-docsUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-full-i18nUpgrade libnghttp2-develUpgrade nodejs24-debuginfoUpgrade nodejs22-debuginfoUpgrade nghttp2Upgrade v8-12.4-develUpgrade nodejs22-libs-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-full-i18nUpgrade nodejs22-libsUpgrade nodejs22-develUpgrade nodejs22-debugsourceUpgrade libnghttp2-debuginfoUpgrade nodejs24Upgrade libnghttp2Upgrade nodejs24-npmUpgrade nodejs22-docsUpgrade nodejs24-develUpgrade nghttp2-debugsourceUpgrade nodejs24-debugsourceUpgrade nodejs22-npmUpgrade nodejs24-libsUpgrade nodejs22Upgrade nghttp2-debuginfo | Apr 14, 2026 | Mar 18, 2026 |
| Debian | — | Upgrade nghttp2 | May 14, 2026 | May 14, 2026 |
| Freebsd | — | Upgrade nghttp2Upgrade libnghttp2 | Apr 6, 2026 | Apr 5, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Jun 2, 2026 |
| Oracle_linux | — | Upgrade libnghttp2Upgrade nodejs-npmUpgrade nodejs24-docsUpgrade nodejs-docsUpgrade v8-12.4-develUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs24-full-i18nUpgrade nodejsUpgrade libnghttp2-develUpgrade nodejs24-npmUpgrade nodejs24-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs24Upgrade nodejs-libsUpgrade v8-13.6-develUpgrade nghttp2Upgrade npmUpgrade nodejs24-libs | Apr 22, 2026 | Mar 18, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Mar 18, 2026 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs24-docsUpgrade libnghttp2-develUpgrade nodejs-packaging-bundlerUpgrade nodejs24-libsUpgrade nghttp2Upgrade npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-npmUpgrade nodejs24-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs-libsUpgrade nodejs24-develUpgrade libnghttp2Upgrade nodejs-full-i18nUpgrade nodejs24-debugsourceUpgrade nghttp2-debugsourceUpgrade libnghttp2-debuginfoUpgrade nodejs-nodemonUpgrade nodejs24-full-i18nUpgrade nodejs24Upgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nghttp2-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs-debugsourceUpgrade v8-12.4-develUpgrade nodejs-develUpgrade nodejs-npmUpgrade v8-13.6-develUpgrade nodejs-docs | Apr 9, 2026 | Mar 18, 2026 |
| Rocky_linux | — | Upgrade nodejs22-debugsourceUpgrade nodejs-debuginfoUpgrade nghttp2Upgrade nodejs-full-i18nUpgrade libnghttp2-develUpgrade nghttp2-debugsourceUpgrade nodejs24-develUpgrade nodejs-npmUpgrade nodejs24-full-i18nUpgrade nodejs24-libsUpgrade v8-12.4-develUpgrade nodejs-libsUpgrade nodejs24-libs-debuginfoUpgrade npmUpgrade v8-13.6-develUpgrade nodejsUpgrade nodejs24-debugsourceUpgrade libnghttp2Upgrade nodejs-develUpgrade libnghttp2-debuginfoUpgrade nodejs22-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs24Upgrade nodejs24-debuginfoUpgrade nghttp2-debuginfo | Apr 13, 2026 | Apr 10, 2026 |
| Ubuntu | — | Upgrade nghttp2Upgrade libnghttp2-14Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2 (Ubuntu Pro) | May 6, 2026 | May 5, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Mar 18, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub