CVE-2026-123828

Node.js is vulnerable to a one-byte heap buffer overflow in its HTTP/2 Alt-Svc handling within src/node_http2.cc. An unauthenticated remote attacker can trigger the overflow by sending a request with a long, syntactically valid :authority header. When passed to Http2Session.altsvc(), the implemen...