{"affected":[{"defaultStatus":"unaffected","product":"node","source":"CNA: openjs","vendor":"nodejs","versions":[{"lessThan":"24.22.3","status":"affected","version":"24.0.0","versionType":"semver"},{"lessThan":"26.13.1","status":"affected","version":"25.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-123863","cwes":["CWE-617"],"description":"A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: openjs","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.0"}],"modifiedAt":1794420972733,"publishedAt":1794420972733,"references":[{"source":"CNA: openjs","tags":["vendor-advisory"],"url":"https://nodejs.org/en/blog/vulnerability/november-2026-security-releases"},{"source":"CNA: openjs","tags":[],"url":"https://cna.openjsf.org/security-advisories.html"}],"remediation":[],"revision":"9044f1db76402cde6a35df3070b7176b9b948add252927080a427893afd36a26","sources":[{"modifiedAt":1794420972733,"name":"CNA: openjs","retrievedAt":1794424109108,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123863"}],"ssvc":null,"status":"published","title":"Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown","updatedAt":1794424109108}