CVE-2026-56846: Node.js HTTP/2 DoS Vulnerability

CVE-2026-56846 Overview

CVE-2026-56846 is a denial-of-service vulnerability in Node.js HTTP/2 handling. Retained HTTP/2 header blocks bypass the maxSessionMemory limit, enabling remote attackers to exhaust server memory. The flaw is categorized as uncontrolled resource consumption [CWE-400] and affects Node.js 24.x and 22.x release lines.

An unauthenticated attacker on the network can trigger memory exhaustion by sending crafted HTTP/2 traffic. The maxSessionMemory safeguard fails to account for retained header blocks, defeating the accounting logic meant to bound per-session memory usage. Successful exploitation degrades or terminates the Node.js process, disrupting availability of dependent services.

Critical Impact
Remote, unauthenticated attackers can exhaust Node.js server memory over HTTP/2, causing service outages without valid credentials or user interaction.

Affected Products

Node.js 24.x release line
Node.js 22.x release line
Applications and services embedding vulnerable Node.js runtimes with HTTP/2 enabled

Discovery Timeline

2026-08-04 - CVE-2026-56846 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-56846

Vulnerability Analysis

The vulnerability resides in the Node.js HTTP/2 implementation, which retains header block structures outside the accounting used by the maxSessionMemory safeguard. The maxSessionMemory option is designed to cap per-session buffered memory and terminate sessions that exceed the threshold. Because retained header blocks fall outside this accounting, an attacker can drive memory usage well beyond the intended ceiling.

An attacker sends HTTP/2 requests that cause the server to allocate and retain header block memory that never counts toward the session budget. Repeated requests, or many concurrent sessions, compound the growth until the process exhausts available memory. The resulting condition halts request processing and can crash the Node.js process, affecting all connected clients.

The issue is exploitable across a network path without authentication or user interaction. Any Node.js application exposing an HTTP/2 endpoint, directly or behind a proxy that forwards HTTP/2, is in scope. See the Node.js July 2026 Vulnerability Blog for the vendor advisory.

Root Cause

The root cause is incomplete memory accounting in the HTTP/2 stack. Retained header blocks are not attributed to the session's tracked memory, so the maxSessionMemory enforcement never triggers even when actual usage exceeds the configured limit. This is a classic uncontrolled resource consumption defect [CWE-400].

Attack Vector

The attack vector is network-based. An attacker establishes HTTP/2 sessions with a vulnerable Node.js server and issues header-heavy traffic patterns that force the runtime to retain header blocks outside the accounted memory. The Node.js July 2026 security release notes describe the underlying condition and provide fixed versions.

No verified public exploitation code is available at the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-56846

Indicators of Compromise

Sustained memory growth in Node.js worker processes serving HTTP/2 traffic, unrelated to legitimate workload increases.
Node.js process terminations with out-of-memory errors or heap allocation failures in application logs.
Bursts of HTTP/2 sessions from a small number of source addresses immediately preceding memory spikes.

Detection Strategies

Baseline resident set size (RSS) and heap usage per Node.js process, then alert on deviations that correlate with HTTP/2 request volume.
Inspect HTTP/2 traffic for abnormal header frame counts, oversized header blocks, or unusual HEADERS and CONTINUATION frame ratios.
Correlate application crash events with reverse proxy access logs to identify the client sessions that preceded the failure.

Monitoring Recommendations

Enable process-level metrics via Node.js process.memoryUsage() and export them to your observability platform.
Monitor HTTP/2 session counts and header sizes at the edge proxy or load balancer.
Alert on repeated Node.js restarts within short windows, which often indicate resource exhaustion abuse.

How to Mitigate CVE-2026-56846

Immediate Actions Required

Upgrade Node.js to the fixed 24.x and 22.x releases listed in the Node.js July 2026 Vulnerability Blog.
Inventory all Node.js runtimes across containers, serverless functions, and embedded appliances to identify vulnerable versions.
Restart affected services after patching to ensure the new runtime is loaded.

Patch Information

The Node.js project addressed the vulnerability in its July 2026 security releases for the 24.x and 22.x lines. Refer to the Node.js July 2026 Vulnerability Blog for exact fixed version numbers and upgrade guidance.

Workarounds

Disable HTTP/2 on Node.js endpoints where the protocol is not required, forcing clients to HTTP/1.1.
Terminate HTTP/2 at an upstream reverse proxy that enforces strict header size and rate limits, and forward HTTP/1.1 to Node.js.
Apply per-source connection and request rate limits to reduce the impact of abusive HTTP/2 sessions until patches are deployed.

bash

# Example NGINX front-end limits to reduce HTTP/2 abuse against upstream Node.js
http {
    limit_conn_zone $binary_remote_addr zone=perip:10m;
    limit_req_zone  $binary_remote_addr zone=reqs:10m rate=20r/s;

    server {
        listen 443 ssl;
        http2 on;

        large_client_header_buffers 4 8k;
        client_header_buffer_size 4k;

        limit_conn perip 50;
        limit_req  zone=reqs burst=40 nodelay;

        location / {
            proxy_http_version 1.1;
            proxy_pass http://nodejs_backend;
        }
    }
}