CVE-2026-48619: Node.js HTTP/2 Client DoS Vulnerability

CVE-2026-48619 Overview

CVE-2026-48619 is a denial-of-service vulnerability in the Node.js HTTP/2 client implementation. A malicious HTTP/2 server can send an unlimited number of ORIGIN frames to a connected Node.js client. The client stores these frames without applying any upper bound, which drives memory consumption until the process terminates with an Out of Memory (OOM) error. The flaw affects all supported release lines, including Node.js 22, 24, and 26. The Node.js project categorizes the issue under [CWE-400] Uncontrolled Resource Consumption. Because Node.js applications frequently act as HTTP/2 clients when calling upstream APIs, any application that connects to an attacker-controlled or compromised HTTP/2 endpoint is exposed.

Critical Impact
A remote HTTP/2 server can crash any Node.js client process by streaming attacker-controlled ORIGIN frames, disrupting availability of services that depend on outbound HTTP/2 calls.

Affected Products

Node.js 22 (confirmed vulnerable at 22.22.3)
Node.js 24 (confirmed vulnerable at 24.16.0)
Node.js 26 (confirmed vulnerable at 26.3.0)

Discovery Timeline

2026-06-26 - CVE-2026-48619 published to NVD
2026-06-26 - Node.js publishes the Node.js June 2026 Security Releases
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-48619

Vulnerability Analysis

HTTP/2 defines the ORIGIN frame (RFC 8336) to let a server advertise additional origins that it is authoritative for on the same connection. A compliant client stores these origins in an in-memory set used to decide whether existing connections can be reused for other hosts. The Node.js HTTP/2 client accepts and retains ORIGIN frames without enforcing a maximum count or total byte size. An attacker who controls the server side of a session can therefore emit ORIGIN frames continuously, forcing the client to allocate memory on every frame until the V8 heap or the process address space is exhausted. The result is process termination and loss of availability for the calling application.

Root Cause

The root cause is missing resource limits on parsed protocol state. The ORIGIN frame handler appends entries to a per-session structure without capping cardinality or aggregate payload size, which is a classic Uncontrolled Resource Consumption pattern.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. A victim Node.js process must initiate an HTTP/2 client connection to a server the attacker controls, or to a legitimate server that has been compromised or is reachable through a man-in-the-middle position. Once the session is established, the server streams a large volume of ORIGIN frames on the connection until the client process runs out of memory.

No public proof-of-concept is available. The technical mechanism is described in prose only; see the Node.js June 2026 Security Releases advisory for vendor details.

Detection Methods for CVE-2026-48619

Indicators of Compromise

Node.js processes terminating with FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory shortly after opening outbound HTTP/2 sessions.
Sudden, sustained growth of resident set size (RSS) in Node.js workers correlated with a single long-lived HTTP/2 connection.
Repeated crash-restart cycles in services that make outbound HTTP/2 API calls to third-party or untrusted endpoints.

Detection Strategies

Instrument HTTP/2 client sessions with http2.getDefaultSettings() telemetry and log frame-type counters, alerting on abnormal ratios of ORIGIN frames per session.
Deploy egress inspection on TLS-terminating proxies to count HTTP/2 ORIGIN frame types per connection and flag sessions exceeding a reasonable threshold.
Correlate Node.js OOM exits in container orchestration logs with outbound connection metadata to identify the offending upstream host.

Monitoring Recommendations

Track per-process memory growth rate for Node.js services and alert on sustained linear growth tied to a single socket.
Monitor outbound HTTP/2 destinations and maintain an allowlist for services that need to speak HTTP/2 to external hosts.
Ingest Node.js runtime logs and crash dumps into a centralized SIEM to correlate OOM events with network activity.

How to Mitigate CVE-2026-48619

Immediate Actions Required

Upgrade Node.js to the patched releases published in the June 2026 security releases for the 22, 24, and 26 lines.
Audit applications that use http2.connect() or libraries built on the core http2 module and identify outbound HTTP/2 dependencies.
Restrict outbound HTTP/2 traffic to trusted destinations using egress firewall rules until patched runtimes are deployed.

Patch Information

The Node.js project released fixed builds across the 22, 24, and 26 release lines. Upgrade guidance and the full list of patched versions are documented in the Node.js June 2026 Security Releases advisory. Container images, serverless runtimes, and bundled Node.js binaries in third-party products must be rebuilt or updated to include the fixed release.

Workarounds

Disable HTTP/2 client usage where feasible and fall back to HTTP/1.1 for outbound API calls until patches are applied.
Set a conservative --max-old-space-size and run Node.js workers under a supervisor so OOM crashes trigger controlled restarts rather than cascading failures.
Route outbound HTTP/2 traffic through a reverse proxy that terminates HTTP/2 and re-originates requests, isolating the vulnerable client code path from untrusted servers.

bash

# Verify the installed Node.js version and upgrade using nvm
node --version
nvm install --lts
nvm alias default 'lts/*'

# Container example: pin to a patched Node.js base image
# Dockerfile
# FROM node:24-alpine  # ensure this tag resolves to the June 2026 patched build