What is the CVSS score of CVE-2026-56846?

CVE-2026-56846 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Node.js are affected by CVE-2026-56846?

Node.js v22.x LTS deployments face unauthenticated denial-of-service vulnerability that can interrupt service availability through memory exhaustion with a trivial network attack.. A patch is available.

How to fix or mitigate CVE-2026-56846?

Within 24 hours, identify all systems running Node.js v22.x LTS prior to v22.23.2 and confirm their exposure to untrusted network traffic. Within 7 days, upgrade all affected instances to Node.js v22.23.2 or later (released 2026-07-29), which contains the security fix for the HTTP/2 memory accounting bypass. Within 30 days, validate the upgrade across your full deployment pipeline, establish baseline memory metrics for HTTP/2 endpoints, and configure alerting for abnormal memory consumption to detect future exploitation attempts.

Node.js CVE-2026-56846

EUVD-2026-52564 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-29

GHSA-frc8-j9wv-2348

Denial Of Service

7.5

CVSS 3.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable HTTP/2 endpoint, no auth or interaction needed; impact is availability-only process crash with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 04, 2026 - 01:23 vuln.today

Analysis Generated

Aug 04, 2026 - 01:23 vuln.today

CVSS changed

Aug 04, 2026 - 01:22 NVD

7.5 (HIGH)

CVE Published

Jul 29, 2026 - 14:00 github-releases

UNKNOWN (no severity yet)

CVE Published

Jul 29, 2026 - 14:00 github-releases

HIGH 7.5

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

Uncontrolled resource consumption in Node.js HTTP/2 implementation allows unauthenticated remote attackers to exhaust server memory and cause denial of service by sending crafted requests that bypass session-level header memory accounting. Affected is Node.js v22.x LTS ('Jod' line) prior to v22.23.2, fixed in the security release published 2026-07-29. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) reflects realistic network-level exploitability with no authentication barrier.

Technical ContextAI

The vulnerability resides in Node.js's built-in HTTP/2 stack, specifically in the session-level memory accounting logic that tracks header memory. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause: header memory allocated during HTTP/2 request processing was not being correctly retained or charged against the session's memory budget, allowing an attacker to exhaust process memory without triggering session-level throttling or back-pressure. HTTP/2 multiplexes multiple streams over a single connection with HPACK header compression and per-stream/per-connection flow control; when the session accounting for headers is broken, an attacker can open streams and send header blocks that accumulate unbounded in memory. The fix commit (hash 'retain header memory in session accounting' by Matteo Collina) corrects this accounting. The Node.js v22 LTS line (CPE: cpe:2.3:a:nodejs:node.js:22.*:*:*:*:lts:*:*:*) is affected up to and excluding v22.23.2.

RemediationAI

Upgrade Node.js to v22.23.2 or later; this is the vendor-released patch for CVE-2026-56846 (https://github.com/nodejs/node/releases/tag/v22.23.2). If an immediate upgrade is not feasible, consider disabling HTTP/2 support in the Node.js application and falling back to HTTP/1.1 - this eliminates the vulnerable code path entirely but may impact performance for high-concurrency workloads relying on HTTP/2 multiplexing. Alternatively, placing a reverse proxy (e.g., nginx or HAProxy) in front of the Node.js service to terminate HTTP/2 and forward HTTP/1.1 to the backend can isolate the vulnerable stack from untrusted clients, though this introduces additional infrastructure complexity. Rate-limiting connections and enforcing per-IP connection caps at the network perimeter can reduce the impact of exploitation attempts but will not prevent a determined attacker from triggering memory exhaustion over a sustained low-rate attack. Verify other concurrent CVEs in this release (CVE-2026-56848, CVE-2026-58043) are also addressed by the same v22.23.2 upgrade.

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

7.5

CVE-2026-45498 HIGH POC

7.5

CVE-2016-8610 HIGH

7.5

CVE-2026-28318 HIGH POC

7.5

7.5

7.5

7.5

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Affected
SUSE Linux Enterprise High Performance Computing 12	Affected

CVE-2026-56846 vulnerability details – vuln.today

Back

Node.js CVE-2026-56846

Severity by source

CVSS VectorVendor

Lifecycle Timeline

Description PRE-NVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-400 – Uncontrolled Resource Consumption

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code