cve.bz

CVE-2026-123828 Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long origin

5.9 mediumEPSS 0.5%

Medium (5.9) in nodejs node. EPSS 0.5% estimated probability of exploitation activity in the next 30 days.

On this page
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x.

Severity

CVSS 3.0

5.9 medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.5% estimated probability of exploitation activity in the next 30 days; 46th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
CWE
CWE-122 Heap-based Buffer Overflow
Published
Modified
Assigned by
openjs (CNA)
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-123828 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-123828?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-123828?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-123828 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Badge for a README or a site

CVE-2026-123828

An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:

[![CVE-2026-123828](https://cve.bz/cve/badge/CVE-2026-123828.svg)](https://cve.bz/cve/CVE-2026-123828)

HTML:

<a href="https://cve.bz/cve/CVE-2026-123828"><img src="https://cve.bz/cve/badge/CVE-2026-123828.svg" alt="CVE-2026-123828"></a>

Affected

Versions

From the CNA's record in the CVE List.

ProductAffected
nodejs nodefrom 24.0.0 before 24.22.3
nodejs nodefrom 25.0.0 before 26.13.1

Fix and patched versions

Linux distributions

DistributionReleasePackageFixed inAdvisory
Debian12, 13, 14nodejsno fix listedDEBIAN-CVE-2026-123828
Ubuntu24.04:LTS, 26.04:LTS, 26.10 and 5 morenodejsno fix listedUBUNTU-CVE-2026-123828
Red Hathummingbird:1nodejs22, nodejs22-bin, nodejs22-docs and 4 more1:22.23.4-2.3.2.3.1.hum1RHSA-2026:93603
Red Hathummingbird:1nodejs22-npm1:10.9.9-1.22.23.4.2.3.2.3.1.hum1RHSA-2026:93603
Red Hathummingbird:1nodejs24, nodejs24-bin, nodejs24-docs and 3 more1:24.22.3-0.1.hum1RHSA-2026:99435
Red Hathummingbird:1nodejs24-npm2:11.19.1-1.24.22.3.0.1.hum1RHSA-2026:99435
Red Hathummingbird:1nodejs24-npm-bin2:24.22.3-0.1.hum1RHSA-2026:99435
Red Hathummingbird:1nodejs26, nodejs26-bin, nodejs26-docs and 4 more1:26.13.1-0.1.hum1RHSA-2026:99436
Red Hathummingbird:1nodejs26-npm1:11.20.0-1.26.13.1.0.1.hum1RHSA-2026:99436
Red Hathummingbird:1v8-12.4-devel3:12.4.254.21-1.22.23.4.2.3.2.3.1.hum1RHSA-2026:93603
Alpinev3.21, v3.22nodejs22.23.5-r0ALPINE-CVE-2026-123828
Alpinev3.23, v3.24nodejs24.22.3-r0ALPINE-CVE-2026-123828
Alpinev3.24nodejs-current26.13.1-r0ALPINE-CVE-2026-123828
Alpaquitastreamnodejs2222.23.5-r0BELL-CVE-2026-123828
Alpaquitastreamnodejs2424.22.3-r0BELL-CVE-2026-123828
Alpaquitastreamnodejs2626.13.1-r0BELL-CVE-2026-123828
BellSoft Hardened Containersstreamnodejs2222.23.5-r0BELL-CVE-2026-123828
BellSoft Hardened Containersstreamnodejs2424.22.3-r0BELL-CVE-2026-123828
BellSoft Hardened Containersstreamnodejs2626.13.1-r0BELL-CVE-2026-123828

From the distributions' data via OSV.dev: the Debian Security Tracker; Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0; Red Hat Security Data © Red Hat, Inc., CC BY 4.0; the Alpine secdb, CC BY-SA 4.0; BellSoft's OSV database, MIT. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian · Ubuntu · Red Hat · Alpine · Alpaquita · BellSoft Hardened Containers.

Red Hat

Red Hat rates this Moderate.

Red Hat's statement

Red Hat has evaluated this vulnerability as Moderate severity because exploitation requires specific application-level code to process untrusted input through the HTTP/2 Alternative Services API, limiting broad exposure despite potential process crashes. Standard deployments do not automatically pass client-controlled headers to this interface. The flaw primarily presents an availability risk through application termination rather than arbitrary code execution under standard runtime protections.

Red Hat's mitigation

Do not pass attacker-controlled values such as the request :authority into Http2Session.altsvc(). If Alt-Svc is unused, terminate HTTP/2 at a reverse proxy and avoid calling altsvc() with untrusted input.

ProductPackageStateAdvisory
Red Hat Hardened Imagesnodejs22-main-10.9.9-1.22.23.4.2.3.2.3.1.hum1Fixed 2026-11-02RHSA-2026:93603
Red Hat Hardened Imagesnodejs22-main-22.23.4-2.3.2.3.1.hum1Fixed 2026-11-02RHSA-2026:93603
Red Hat Enterprise Linux 10nodejs22Not affected
Red Hat Enterprise Linux 10nodejs24Fix deferred
Red Hat Enterprise Linux 10nodejs26Fix deferred
Red Hat Enterprise Linux 8nodejs:22/nodejsNot affected
Red Hat Enterprise Linux 8nodejs:24/nodejsFix deferred
Red Hat Enterprise Linux 9nodejs:22/nodejsNot affected
Red Hat Enterprise Linux 9nodejs:24/nodejsFix deferred
Red Hat Enterprise Linux 9nodejs:26/nodejsFix deferred
Red Hat Hardened Imageshi/nodejsUnder investigation
Red Hat Hardened Imagesnodejs20Will not fix
Red Hat Hardened Imagesnodejs24Affected
Red Hat Hardened Imagesnodejs25Will not fix
Red Hat Hardened Imagesnodejs26Affected
Red Hat Hardened Imagesnpm12Under investigation

Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-123828.

Attack patterns (CAPEC)

  • CAPEC-92 Forced Integer Overflow Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.

References

Check your stackJSON