Skip to content
Sign in
5.3 Medium

CVE-2026-48937 A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame

Description

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.

Affected products and versions

Product Affected versions Fixed in
Node 24.16.0 No fix stated
Node 22.22.3 No fix stated

Other CVEs of Node

The 129 CVEs of Node →
CVE-2026-106070 A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after… 3.7 Low CVE-2026-106071 A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard… 3.6 Low CVE-2026-106074 A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`,… 4.8 Medium CVE-2026-106073 A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read… 3.3 Low
Track this CVE