GHSA-frc8-j9wv-2348

Опубликовано: 04 авг. 2026

Источник: github

Github: Не прошло ревью

CVSS3: 7.5

Описание

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.

This vulnerability affects Node.js 24.x and 22.x.

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion.

This vulnerability affects Node.js 24.x and 22.x.

Ссылки

EPSS

Процентиль: 43%

0.00548

Низкий

7.5 High

CVSS3

CVE ID

CVE-2026-56846

Дефекты

CWE-400

Связанные уязвимости

CVE-2026-56846

CVSS3: 7.5

ubuntu

4 дня назад

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

CVE-2026-56846

CVSS3: 7.5

nvd

4 дня назад

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.

CVE-2026-56846

CVSS3: 7.5

debian

4 дня назад

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blo ...

EPSS

Процентиль: 43%

0.00548

Низкий

7.5 High

CVSS3

CVE ID

CVE-2026-56846

Дефекты

CWE-400