The vulnerability of the node_http2 components in the Node.js software platform allows a attacker to cause a service failure.

🗓️ 09 Feb 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Node_http2 vulnerability in Node.js due to insufficient input validation can cause service failures.

Reporter	Title	Published	Views	Family All 105
ALT Linux	Security fix for the ALT Linux 10 package node version 8.11.3-alt1	30 Jun 201800:00	–	altlinux
IBM Security Bulletins	Security Bulletin: IBM API Connect has addressed multiple vulnerabilities in Developer Portal's dependencies - Cumulative list from June 28, 2018 to December 13, 2018	28 Jan 201917:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affects IBM Rational Application Developer for WebSphere Software included in Rational Developer for i	27 Nov 201816:05	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private and IBM Cloud Private Cloud Foundry (CVE-2018-7167, CVE-2018-7164, CVE-2018-7162, CVE-2018-1000168, CVE-2018-7161)	26 Sep 201818:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Integration Bus & IBM App Connect Enterprise V11	20 Nov 201812:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud	11 Sep 201818:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is affected by multiple third-party vulnerabilities (Node.js, nghttp2, Linux, Intel CPU, Android)	31 Oct 201820:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software (CVE-2018-1000168, CVE-2018-7161)	12 Nov 201816:15	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and Business Process Manager (BPM)	15 Sep 202219:20	–	ibm
IBM Security Bulletins	Security Bulletin: Node.js as used in IBM QRadar Packet Capture is susceptible to multiple vulnerabilities	7 Nov 201815:25	–	ibm

Vulners

Node

node.js node.jsRange8.9.0–8.11.3

node.js node.jsRange9.0.0–9.11.2

node.js node.jsRange10.0.0–10.4.1

node.js node.jsRange8.0.0–8.8.1

Source	Link
securityfocus	www.securityfocus.com/bid/106363
github	www.github.com/nodejs/node/commit/8bf213dbdc7e
nodejs	www.nodejs.org/en/blog/vulnerability/june-2018-security-releases/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-7161
security	www.security.gentoo.org/glsa/202003-48
security-tracker	www.security-tracker.debian.org/tracker/CVE-2018-7161
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16
web	www.web.nvd.nist.gov/view/vuln/detail

09 Feb 2026 00:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 37.5

CVSS 27.8

EPSS0.07855