CVE-2026-56848

CVE-2026-56848 affects Node.js 22.x/24.x/26.x. The vulnerability arises from a heap-use-after-free caused by re-entrant nghttp2_session_mem_send() during nghttp2_session_mem_recv(). OSV/OpenSUSE entries show fixes: nodejs26-26.5.1-1.1 and corepack24-24.18.1-1.1 in GA media, with additional OSV De...

CVE-2025-59465

A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not...

CVE-2025-23085

A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory...