Loading vulnerability…
Remote memory exhaustion in Node.js HTTP/2 retained header handling
CVE-2026-56846 is a resource-consumption vulnerability in Node.js HTTP/2 handling affecting the upstream 22.x and 24.x branches. Retained HTTP/2 header blocks can escape maxSessionMemory accounting, allowing memory consumption beyond the configured session limit. A remote, unauthenticated attacker can exploit this behavior to exhaust process memory and cause denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust the affected Node.js process's memory, disrupting service availability and potentially terminating the process. The vulnerability is rated High with CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No confidentiality or integrity impact is established.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Until patched, restrict untrusted access to affected Node.js HTTP/2 endpoints, apply upstream connection and request limits, and monitor process memory for abnormal growth. Isolate or restart affected services when necessary to restore availability. These measures reduce exposure but do not correct the memory-accounting flaw.
Patch, then assume compromise.
Install the security-fixed Node.js packages for the deployed platform and release branch. Applicable SUSE updates include Node.js 22.23.2 and 24.18.1 package builds; supported SUSE Node.js 18 and 20 packages receive distribution-specific backports. RHEL 8 Node.js 24 deployments should apply RHSA-2026:62583, which supplies Node.js 24.19.0 packages. Debian fixes are included in 18.20.4+dfsg-1~deb12u3 for Debian 12 and 20.19.2+dfsg-1+deb13u3 for Debian 13. Use the vendor's fixed package revision rather than inferring vulnerability status solely from the upstream major version.
No validated public exploits yet. Hidden: 3 rejected by Mallory's analysis as not a working exploit.
49 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.