CVE-2026-48937: Node.js HTTP/2 GOAWAY Frame Processing Vulnerability

Technical summary

CVE-2026-48937 is a protocol state management issue in the Node.js HTTP/2 server implementation (CWE-400: Uncontrolled Resource Consumption). The flaw allows HTTP/2 servers to continue accepting and processing data frames after transmitting a GOAWAY frame, which per RFC 7540 should signal connection termination and prevent further stream processing. This violation of HTTP/2 protocol semantics can be leveraged to send resource-intensive requests that the server improperly handles, bypassing the intended graceful shutdown mechanism. The vulnerability affects Node.js 22 and Node.js 24 release lines.

Business impact

The primary risk is denial of service through resource exhaustion. An attacker can exploit the continued data acceptance post-GOAWAY to send computationally expensive or large payloads that consume server memory, CPU, or connection buffers. During periods when a Node.js server is shutting down or load-balancing traffic, this flaw can prevent clean connection closure and amplify the blast radius of a coordinated attack. For production applications relying on graceful shutdown patterns, this introduces operational fragility.

Affected systems

Node.js 22.x and Node.js 24.x release lines are affected. The vulnerability exists in the HTTP/2 server API layer, so any application using Node.js as an HTTP/2 server (commonly deployed behind proxies, in microservices, or as standalone APIs) is potentially impacted. Node.js LTS and current release schedules should be consulted to determine end-of-life dates for each branch.

Exploitability

Exploitability is straightforward: an attacker with network access can send HTTP/2 DATA or HEADERS frames after observing a GOAWAY frame, without requiring authentication or special privileges. The attack is low-complexity and requires no user interaction. The CVSS 3.0 score of 5.3 (MEDIUM) reflects the availability impact; confidentiality and integrity are not directly compromised. As of the published date, this is not listed on CISA's KEV catalog, indicating no known active exploitation, though the simplicity of the attack vector warrants prompt patching.

Remediation

Apply security updates from the Node.js project for the affected release lines. Consult the official Node.js security advisories and release notes for patch version numbers specific to Node.js 22 and 24. As an interim measure, operators can implement connection-level rate limiting or request size caps at the load balancer or proxy layer to mitigate resource exhaustion attempts, though this does not fix the underlying protocol violation.

Patch guidance

Monitor the Node.js official website and security advisories for release notes addressing CVE-2026-48937. Patches will be issued for the Node.js 22 and 24 branches. Organizations should prioritize testing patches in non-production environments first, then roll out to staging and production in accordance with change management policies. Verify patch application by confirming the updated Node.js version number post-deployment.

Detection guidance

Detection is challenging at the application level since the flaw is in the HTTP/2 protocol state machine. Network-level monitoring for patterns of data arrival after GOAWAY frames may reveal exploitation attempts, though this requires HTTP/2-aware inspection tools. Monitor application logs for unexpected resource consumption spikes or connection exhaustion during shutdown sequences. Intrusion detection systems with HTTP/2 protocol support may flag multiple post-GOAWAY frame sequences from the same source as anomalous.

Why prioritize this

Although the CVSS score is MEDIUM and there is no active known exploitation, the ease of triggering the vulnerability (low complexity, no privileges required) and its impact on availability make this a priority fix for production Node.js services. Organizations running Node.js 22 or 24 in customer-facing or critical infrastructure roles should patch within their standard critical/high patch windows. The lack of KEV listing provides a narrow window to patch before active exploitation tools emerge.

Risk score, explained

The CVSS 3.0 score of 5.3 reflects a network-accessible, low-complexity vulnerability with no confidentiality or integrity impact, but with a measurable availability impact through resource consumption. The score does not increase to HIGH because the attack requires network access and does not affect confidentiality or integrity of data at rest or in transit. However, the low attack complexity and absence of privilege requirements elevate concern beyond the numeric score alone.

Frequently asked questions