Log in Start free

Vulnerability · Published Mar 30, 2026 · Assigned by hackerone

CVE-2026-21714

Medium 5.3

In plain English

A medium-severity memory leak in node from nodejs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)5.3Medium
Exploit odds (30 days)0.4%top 62.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8nodejs1:24.14.1-2.module_el8.10.0+4160+4819ac42ALSA-2026:7670
AlmaLinux:9nodejs1:24.14.1-2.module_el9.7.0+222+ef1c61e1ALSA-2026:7350
AlmaLinux:8nodejs-devel1:24.14.1-2.module_el8.10.0+4160+4819ac42ALSA-2026:7670
AlmaLinux:9nodejs-devel1:24.14.1-2.module_el9.7.0+222+ef1c61e1ALSA-2026:7350
AlmaLinux:8nodejs-docs1:24.14.1-2.module_el8.10.0+4160+4819ac42ALSA-2026:7670
AlmaLinux:9nodejs-docs1:24.14.1-2.module_el9.7.0+222+ef1c61e1ALSA-2026:7350
AlmaLinux:8nodejs-full-i18n1:24.14.1-2.module_el8.10.0+4160+4819ac42ALSA-2026:7670
AlmaLinux:9nodejs-full-i18n1:24.14.1-2.module_el9.7.0+222+ef1c61e1ALSA-2026:7350
AlmaLinux:8nodejs-libs1:24.14.1-2.module_el8.10.0+4160+4819ac42ALSA-2026:7670
AlmaLinux:9nodejs-libs1:24.14.1-2.module_el9.7.0+222+ef1c61e1ALSA-2026:7350
AlmaLinux:8nodejs-nodemon3.0.3-1.module_el8.10.0+4061+f8ceeab9ALSA-2026:7670
AlmaLinux:9nodejs-nodemon3.0.3-3.module_el9.7.0+209+ecf6523eALSA-2026:7350
AlmaLinux:8nodejs-packaging2021.06-6.module_el8.10.0+4086+70facd4aALSA-2026:7670
AlmaLinux:9nodejs-packaging2021.06-6.module_el9.7.0+209+ecf6523eALSA-2026:7350
AlmaLinux:8nodejs-packaging-bundler2021.06-6.module_el8.10.0+4086+70facd4aALSA-2026:7670
AlmaLinux:9nodejs-packaging-bundler2021.06-6.module_el9.7.0+198+8bf605baALSA-2026:7350
AlmaLinux:10nodejs24-docs1:24.14.1-2.el10_1ALSA-2026:7675
AlmaLinux:10nodejs24-npm1:11.11.0-1.24.14.1.2.el10_1ALSA-2026:7675
AlmaLinux:8npm1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42ALSA-2026:7670
AlmaLinux:9npm1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1ALSA-2026:7350
AlmaLinux:8v8-13.6-devel3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42ALSA-2026:7670
AlmaLinux:9v8-13.6-devel3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1ALSA-2026:7350
Alpine:v3.21nodejs22.22.2-r0ALPINE-CVE-2026-21714
Alpine:v3.22nodejs22.22.2-r0ALPINE-CVE-2026-21714
Alpine:v3.23nodejs24.14.1-r0ALPINE-CVE-2026-21714
Alpine:v3.24nodejs24.14.1-r0ALPINE-CVE-2026-21714
Debian:12nodejs18.20.4+dfsg-1~deb12u2DEBIAN-CVE-2026-21714
Debian:13nodejs20.19.2+dfsg-1+deb13u2DSA-6183-1
Debian:13nodejs20.19.2+dfsg-1+deb13u2DEBIAN-CVE-2026-21714
Debian:14nodejs22.22.2+dfsg+~cs22.19.15-1DEBIAN-CVE-2026-21714
Rocky Linux:8nodejs-nodemon0:3.0.3-1.module+el8.10.0+2084+ab509703RLSA-2026:7670
Rocky Linux:9nodejs-nodemon0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2RLSA-2026:7350
Rocky Linux:8nodejs-packaging0:2021.06-6.module+el8.10.0+40048+6d99f608RLSA-2026:7670
Rocky Linux:9nodejs-packaging0:2021.06-6.module+el9.7.0+40052+e32ea525RLSA-2026:7350
Rocky Linux:10nodejs241:24.14.1-2.el10_1RLSA-2026:7675
Ubuntu:24.04:LTSnodejsno fix listedUBUNTU-CVE-2026-21714
Ubuntu:25.10nodejsno fix listedUBUNTU-CVE-2026-21714
Ubuntu:26.04:LTSnodejsno fix listedUBUNTU-CVE-2026-21714
Ubuntu:26.10nodejsno fix listedUBUNTU-CVE-2026-21714

Affected products (as reported)

VendorProductVersions
nodejs node 20.20.1 – through 20.20.122.22.1 – through 22.22.124.14.0 – through 24.14.025.8.1 – through 25.8.1

Weakness: CWE-401 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References