A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• nodejs node.js22.22.3
• nodejs node.js24.16.0
• nodejs node.js26.3.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hackerone). Independent of NVD's CPE analysis and usually ahead of it.

• nodejs node

  • 22.22.3 and later · up to and including 22.22.3affected · semver
  • 24.16.0 and later · up to and including 24.16.0affected · semver
  • 26.3.0 and later · up to and including 26.3.0affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2019-15605HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
  56Plan
• CVE-2021-22883Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an
  53Plan
• CVE-2021-22930Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory c
  50Plan

Published before and after this one in the same product

• ← EarlierCVE-2026-48615Jun 25, 2026 · A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.
  30Monitor
• ← EarlierCVE-2026-48618Jun 25, 2026 · A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypas
  27Monitor
• Later →CVE-2026-48928Jun 25, 2026 · A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.
  21Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.