Skip to main content

Node.js CVE-2026-48937

| EUVDEUVD-2026-37928 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-06-18 GHSA-p9qf-hwxr-qhff
Denial Of Service Node.js Node Js
7.5
CVSS 3.1 · NVD
Share

Severity by source

Vendor (CNA) PRIMARY
MEDIUM
qualitative
NVD
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

HTTP/2 endpoint reachable over network without credentials; resource exhaustion causes availability loss only, with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (CNA).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

8
Analysis Updated
Aug 18, 2026 - 18:14 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 18, 2026 - 18:07 vuln.today
cvss_changed
Severity Changed
Aug 18, 2026 - 18:07 NVD
MEDIUM HIGH
CVSS changed
Aug 18, 2026 - 18:07 NVD
5.3 (MEDIUM) 7.5 (HIGH)
Source Code Evidence Fetched
Jun 18, 2026 - 19:41 vuln.today
Analysis Generated
Jun 18, 2026 - 19:41 vuln.today
CVSS changed
Jun 18, 2026 - 19:38 NVD
5.3 (MEDIUM)
CVE Published
Jun 18, 2026 - 04:37 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

Uncontrolled resource consumption in Node.js's HTTP/2 stack (≤24.16.0 and ≤22.22.3) enables remote unauthenticated denial-of-service via integration defects between Node.js and its bundled nghttp2 dependency (updated to 1.69.0 in the fix). The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects fully network-exploitable, zero-interaction availability impact. No public exploit or active exploitation has been identified at time of analysis (EPSS 0.40%, SSVC exploitation: none), though CISA SSVC classifies the attack as automatable.

Technical ContextAI

Node.js embeds nghttp2, a C library implementing the HTTP/2 framing and session layer (RFC 7540). CVE-2026-48937 is rooted in integration defects between Node.js's HTTP/2 bindings and nghttp2 - surfaced when nghttp2 was updated to 1.69.0 - that allow the library to be driven into an uncontrolled resource consumption state (CWE-400). The fix, commit a8a0d12875, patches the Node.js integration layer (deps/) to handle behavioral changes in nghttp2 1.69.0 correctly. Affected CPE: cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* covering both the 24.x and 22.x LTS lines. Note that a related but distinct CVE (CVE-2026-48619) addresses HTTP/2 originSet unbounded memory growth in the same release, both falling under the HTTP/2 resource-exhaustion class.

RemediationAI

Upgrade to Node.js v24.17.0 ('Krypton' LTS) on the 24.x line; the corresponding fixed version for the 22.x LTS line should be confirmed via https://nodejs.org/en/blog/vulnerability/june-2026-security-releases, as the exact 22.x patch version is not specified in available data. SUSE Linux Enterprise administrators should apply SUSE-SU-2026:2633 or SUSE-SU-2026:2647 as appropriate. The upstream fix is commit a8a0d12875 (PR #62891 in nodejs/node). As a compensating control prior to patching, placing a reverse proxy (nginx, HAProxy, Envoy) with HTTP/2 connection and stream rate limits in front of Node.js will reduce the blast radius - note this adds latency and does not fully eliminate the flaw. Disabling HTTP/2 entirely (forcing HTTP/1.1) fully mitigates the nghttp2 integration path at the cost of multiplexing and header compression benefits.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-48937 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy