CVE-2026-56846

Опубликовано: 04 авг. 2026

Источник: debian

Описание

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

Пакеты

Пакет	Статус	Версия исправления	Релиз	Тип
nodejs	unfixed			package

Примечания

https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#http2-retained-headers-can-bypass-maxsessionmemory-limits-cve-2026-56846---high

Связанные уязвимости

CVE-2026-56846

CVSS3: 7.5

ubuntu

3 дня назад

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

CVE-2026-56846

CVSS3: 7.5

nvd

3 дня назад

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

GHSA-frc8-j9wv-2348

CVSS3: 7.5

github

3 дня назад

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.