Skip to main content

Node.js CVE-2026-48619

| EUVDEUVD-2026-39607 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-06-18 GHSA-v3cq-r2f8-qmmc
Denial Of Service Node.js Red Hat Suse Node Js
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Remote peer triggers unbounded memory growth over HTTP/2 with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H), no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.3 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

9
Analysis Updated
Jun 26, 2026 - 20:33 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 26, 2026 - 20:33 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 26, 2026 - 20:22 vuln.today
cvss_changed
Severity Changed
Jun 26, 2026 - 20:22 NVD
MEDIUM HIGH
CVSS changed
Jun 26, 2026 - 20:22 NVD
5.3 (MEDIUM) 7.5 (HIGH)
Source Code Evidence Fetched
Jun 26, 2026 - 02:24 vuln.today
Analysis Generated
Jun 26, 2026 - 02:24 vuln.today
CVSS changed
Jun 26, 2026 - 02:22 NVD
5.3 (MEDIUM)
CVE Published
Jun 18, 2026 - 04:37 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

Denial of service in Node.js HTTP/2 lets a remote peer exhaust process memory by driving unbounded growth of the connection's originSet, the structure that tracks origins advertised via HTTP/2 ORIGIN frames. It affects the 22.x, 24.x and 26.x release lines up to and including Node 22.22.3, 24.16.0 and 26.3.0, and is fixed in the June 2026 security release (26.3.1). There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.51%), but availability impact is rated High.

Technical ContextAI

The flaw lives in Node.js's core http2 implementation and concerns the originSet - the client-side set of origins a server may claim authority over, populated from HTTP/2 ORIGIN frames (RFC 8336) on a coalesced connection. CWE-400 (Uncontrolled Resource Consumption) is the root-cause class: before the fix the originSet had no size cap, so a peer that continuously advertises distinct origins forces the set to grow without bound, consuming heap memory until the process is starved or crashes. The affected component is the JavaScript/C++ http2 session layer, identified in NVD CPE data as cpe:2.3:a:nodejs:node.js across the 22.22.3, 24.16.0 and 26.3.0 builds; the remediation commit by Matteo Collina simply caps the originSet size.

RemediationAI

Vendor-released patch: Node.js 26.3.1, which caps the originSet size; upgrade the 26.x line to 26.3.1 (or later). For the 22.x and 24.x lines a fix is shipped as part of the same June 2026 security release, but the exact patched 22.x/24.x version numbers are not stated in the provided data, so confirm them against the Node.js June 2026 security release blog (https://nodejs.org/en/blog/vulnerability/june-2026-security-releases) and the v26.3.1 release notes (https://github.com/nodejs/node/releases/tag/v26.3.1) before deploying. If you cannot upgrade immediately, the effective compensating control is to avoid using the http2 module to make or accept HTTP/2 connections with untrusted peers (for example, terminate HTTP/2 at a hardened reverse proxy such as nginx and speak HTTP/1.1 to the Node process, or disable ORIGIN-frame-driven coalescing), and to enforce per-process memory limits/restart-on-OOM so a memory-growth attack degrades gracefully rather than taking down the host; the trade-off is reduced HTTP/2 functionality and connection-reuse efficiency.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-48619 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy