{"affected":[{"defaultStatus":"unaffected","product":"node","source":"CNA: openjs","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-123828","cwes":["CWE-122"],"description":"A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: openjs","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.0"}],"modifiedAt":1794420654030,"publishedAt":1794420654030,"references":[{"source":"CNA: openjs","tags":["vendor-advisory"],"url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"},{"source":"CNA: openjs","tags":[],"url":"https://cna.openjsf.org/security-advisories.html"}],"remediation":[],"revision":"ed5258fa52cff1de8c718251ffa9767eeb800116a7ee364374e80f5ef1642462","sources":[{"modifiedAt":1794420654030,"name":"CNA: openjs","retrievedAt":1794424105576,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123828"}],"ssvc":null,"status":"published","title":"Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long origin","updatedAt":1794424105576}