GHSA-frc8-j9wv-2348

Опубликовано: 04 авг. 2026

Источник: github

Github: Не прошло ревью

CVSS3: 7.5

Описание

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.

This vulnerability affects Node.js 24.x and 22.x.

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.

This vulnerability affects Node.js 24.x and 22.x.

Ссылки

EPSS

Процентиль: 42%

0.005

Низкий

7.5 High

CVSS3

CVE ID

CVE-2026-56846

Дефекты

CWE-400

Связанные уязвимости

CVE-2026-56846

CVSS3: 7.5

ubuntu

около 2 месяцев назад

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

CVE-2026-56846

CVSS3: 7.5

redhat

около 2 месяцев назад

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

CVE-2026-56846

CVSS3: 7.5

nvd

около 2 месяцев назад

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

CVE-2026-56846

CVSS3: 7.5

debian

около 2 месяцев назад

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blo ...

RLSA-2026:62583

rocky

19 дней назад

Important: nodejs:24 security update

EPSS

Процентиль: 42%

0.005

Низкий

7.5 High

CVSS3

CVE ID

CVE-2026-56846

Дефекты

CWE-400