A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 5, 2026 | Aug 4, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs24Upgrade nodejs24-npmUpgrade nodejs22-npmUpgrade nodejs22-debuginfoUpgrade nodejs24-full-i18nUpgrade v8-13.6-develUpgrade nodejs24-debuginfoUpgrade nodejs22-full-i18nUpgrade nodejs24-libsUpgrade v8-12.4-develUpgrade nodejs22Upgrade nodejs22-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-docsUpgrade nodejs22-libsUpgrade nodejs22-docsUpgrade nodejs22-debugsourceUpgrade nodejs24-debugsourceUpgrade nodejs22-devel | Aug 18, 2026 | Aug 4, 2026 |
| Redhat_linux | — | Upgrade v8-13.6-develUpgrade nodejs24-full-i18nUpgrade nodejs24-debuginfoUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs24-develUpgrade nodejs24Upgrade nodejs-libs-debuginfoUpgrade nodejs24-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs24-debugsourceUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs24-npmNo solution existsUpgrade v8-12.4-develUpgrade nodejs24-docsUpgrade nodejs-packagingUpgrade nodejs22-debuginfoUpgrade nodejs-libsUpgrade nodejs-npmUpgrade nodejs22-debugsourceUpgrade nodejs-nodemonUpgrade nodejs24-libs-debuginfo | Aug 10, 2026 | Aug 4, 2026 |
| Rocky_linux | — | Upgrade v8-12.4-develUpgrade nodejs-libs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs-libsUpgrade nodejs-npmUpgrade v8-13.6-develUpgrade nodejs-full-i18nUpgrade nodejs24-debuginfoUpgrade nodejs-develUpgrade nodejs22-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs22-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs24Upgrade npm | Sep 2, 2026 | Aug 31, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub