CVE-2026-48619: Node.js HTTP/2 Client Out-of-Memory Denial of Service

Technical summary

CVE-2026-48619 is an HTTP/2 protocol handling defect in Node.js where the client implementation fails to enforce limits on ORIGIN frames received from a server. An attacker controlling a server can exploit this to send unbounded ORIGIN frames, triggering an Out of Memory condition in the client. The vulnerability is rooted in insufficient resource validation (CWE-400: Uncontrolled Resource Consumption) and requires network access but no authentication or user interaction. The CVSS 3.1 score of 7.5 reflects the high availability impact with no confidentiality or integrity compromise.

Business impact

For organizations running Node.js applications that connect to external HTTP/2 servers, this vulnerability poses a denial-of-service risk. Client applications could crash unexpectedly when communicating with untrusted or compromised servers, impacting service availability. This is particularly relevant for microservices architectures, API clients, and backend services that rely on HTTP/2 for performance. The lack of exposure to data breach or system compromise lessens the strategic risk, but operational disruption during attacks remains a concern.

Affected systems

The vulnerability affects Node.js 22, 24, and 26—all current supported release lines as of the vulnerability publication date. Any application built on these versions that uses the Node.js HTTP/2 client API is potentially vulnerable when connecting to untrusted or attacker-controlled servers. Applications using HTTP/2 servers (as opposed to clients) are not affected.

Exploitability

Exploitation requires network access and the ability to operate or control an HTTP/2 server that a Node.js client connects to. No authentication is required, and the attack is trivial to execute once a client establishes a connection—the attacker simply sends malformed or excessive ORIGIN frames. This makes the vulnerability highly exploitable in scenarios involving client connections to third-party APIs, reverse proxies, or untrusted endpoints, though internal network exposure is limited if HTTP/2 connections are restricted to trusted peers.

Remediation

Patch Node.js to the latest available version within your release line (22, 24, or 26) that includes fixes for this vulnerability. Verify patch availability through the official Node.js security advisory and release notes. In the interim, restrict outbound HTTP/2 connections to trusted servers only, disable HTTP/2 protocol support if feasible for your use case, or implement network segmentation to prevent client applications from reaching untrusted endpoints.

Patch guidance

Node.js maintainers will have released patched versions for all three affected release lines. Consult the official Node.js security advisory (nodejs.org/en/security) to identify the specific patch versions for your release line and test thoroughly in pre-production before deploying. Given the simplicity of exploitation, patch deployment should be prioritized within 2–4 weeks depending on your risk tolerance and application criticality.

Detection guidance

Monitor for unexpected memory growth or Out of Memory crashes in Node.js processes, particularly those handling HTTP/2 client connections. Inspect application logs for abnormal disconnections or resource exhaustion warnings. Network-level detection is challenging without deep packet inspection; focus on behavioral indicators such as process memory spikes correlated with remote connection attempts. If you have access to application traces or profiling data, look for excessive ORIGIN frame processing in HTTP/2 session handling.

Why prioritize this

Although this vulnerability does not expose data or enable unauthorized access, the ease of exploitation and impact on availability warrant timely remediation. Any organization with Node.js applications that open HTTP/2 connections to external or semi-trusted servers should treat this as a medium-to-high priority. The fact that all three supported release lines are affected increases the scope of potential impact.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a remotely exploitable denial-of-service condition with no complexity required, resulting in high availability impact. The score does not account for business context—organizations heavily dependent on availability of HTTP/2 clients may assess internal risk as higher, while those without such dependencies may defer patching longer.

Frequently asked questions