Vulnerability · Published Mar 18, 2026 · Assigned by GitHub_M

CVE-2026-27135nghttp2 Denial of service: Assertion failure due to the missing state validation

High 7.5

In plain English

A high-severity security flaw in nghttp2 from nghttp2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 42.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:10	libnghttp2	1.64.0-2.el10_1.1	ALSA-2026:7666
AlmaLinux:8	libnghttp2	1.33.0-6.el8_10.2	ALSA-2026:7667
AlmaLinux:9	libnghttp2	1.43.0-6.el9_7.1	ALSA-2026:7668
AlmaLinux:10	libnghttp2-devel	1.64.0-2.el10_1.1	ALSA-2026:7666
AlmaLinux:8	libnghttp2-devel	1.33.0-6.el8_10.2	ALSA-2026:7667
AlmaLinux:9	libnghttp2-devel	1.43.0-6.el9_7.1	ALSA-2026:7668
AlmaLinux:10	nghttp2	1.64.0-2.el10_1.1	ALSA-2026:7666
AlmaLinux:8	nghttp2	1.33.0-6.el8_10.2	ALSA-2026:7667
AlmaLinux:9	nghttp2	1.43.0-6.el9_7.1	ALSA-2026:7668
AlmaLinux:8	nodejs	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	nodejs	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	nodejs	1:20.20.2-1.module_el8.10.0+4165+3f200bda	ALSA-2026:8339
AlmaLinux:9	nodejs	1:20.20.2-1.module_el9.7.0+226+88d36870	ALSA-2026:7896
AlmaLinux:9	nodejs	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	nodejs-devel	1:20.20.2-1.module_el8.10.0+4165+3f200bda	ALSA-2026:8339
AlmaLinux:8	nodejs-devel	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	nodejs-devel	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:9	nodejs-devel	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:9	nodejs-devel	1:20.20.2-1.module_el9.7.0+224+0af7cc6b	ALSA-2026:7896
AlmaLinux:9	nodejs-devel	1:20.20.2-1.module_el9.7.0+226+88d36870	ALSA-2026:7896
AlmaLinux:10	nodejs-docs	1:22.22.2-1.el10_1	ALSA-2026:7080
AlmaLinux:8	nodejs-docs	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	nodejs-docs	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	nodejs-docs	1:20.20.2-1.module_el8.10.0+4165+3f200bda	ALSA-2026:8339
AlmaLinux:9	nodejs-docs	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:9	nodejs-docs	1:20.20.2-1.module_el9.7.0+224+0af7cc6b	ALSA-2026:7896
AlmaLinux:8	nodejs-full-i18n	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	nodejs-full-i18n	1:20.20.2-1.module_el8.10.0+4165+3f200bda	ALSA-2026:8339
AlmaLinux:8	nodejs-full-i18n	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:9	nodejs-full-i18n	1:20.20.2-1.module_el9.7.0+226+88d36870	ALSA-2026:7896
AlmaLinux:9	nodejs-full-i18n	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:9	nodejs-full-i18n	1:20.20.2-1.module_el9.7.0+224+0af7cc6b	ALSA-2026:7896
AlmaLinux:8	nodejs-libs	1:22.22.2-1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	nodejs-libs	1:24.14.1-2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:9	nodejs-libs	1:24.14.1-2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:8	nodejs-nodemon	3.0.1-1.module_el8.10.0+3982+85c136aa	ALSA-2026:8339
AlmaLinux:8	nodejs-nodemon	3.0.1-1.module_el8.10.0+4006+3c416519	ALSA-2026:7123
AlmaLinux:8	nodejs-nodemon	3.0.3-1.module_el8.10.0+4061+f8ceeab9	ALSA-2026:7670
AlmaLinux:9	nodejs-nodemon	3.0.1-1.module_el9.5.0+125+8dc38870	ALSA-2026:7896
AlmaLinux:9	nodejs-nodemon	3.0.3-3.module_el9.7.0+209+ecf6523e	ALSA-2026:7350
AlmaLinux:8	nodejs-packaging	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:7670
AlmaLinux:8	nodejs-packaging	2021.06-6.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	nodejs-packaging	2021.06-6.module_el8.10.0+4165+3f200bda	ALSA-2026:8339
AlmaLinux:9	nodejs-packaging	2021.06-6.module_el9.7.0+226+88d36870	ALSA-2026:7896
AlmaLinux:9	nodejs-packaging	2021.06-6.module_el9.7.0+209+ecf6523e	ALSA-2026:7350
AlmaLinux:8	nodejs-packaging-bundler	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:7670
AlmaLinux:8	nodejs-packaging-bundler	2021.06-6.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	nodejs-packaging-bundler	2021.06-6.module_el8.10.0+4165+3f200bda	ALSA-2026:8339
AlmaLinux:9	nodejs-packaging-bundler	2021.06-6.module_el9.7.0+226+88d36870	ALSA-2026:7896
AlmaLinux:9	nodejs-packaging-bundler	2021.06-6.module_el9.7.0+198+8bf605ba	ALSA-2026:7350
AlmaLinux:10	nodejs24-docs	1:24.14.1-2.el10_1	ALSA-2026:7675
AlmaLinux:10	nodejs24-npm	1:11.11.0-1.24.14.1.2.el10_1	ALSA-2026:7675
AlmaLinux:8	npm	1:11.11.0-1.24.14.1.2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:8	npm	1:10.9.7-1.22.22.2.1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	npm	1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda	ALSA-2026:8339
AlmaLinux:9	npm	1:10.8.2-1.20.20.2.1.module_el9.7.0+226+88d36870	ALSA-2026:7896
AlmaLinux:9	npm	1:11.11.0-1.24.14.1.2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
AlmaLinux:9	npm	1:10.8.2-1.20.20.2.1.module_el9.7.0+224+0af7cc6b	ALSA-2026:7896
AlmaLinux:8	v8-12.4-devel	3:12.4.254.21-1.22.22.2.1.module_el8.10.0+4158+e796f37f	ALSA-2026:7123
AlmaLinux:8	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module_el8.10.0+4160+4819ac42	ALSA-2026:7670
AlmaLinux:9	v8-13.6-devel	3:13.6.233.17-1.24.14.1.2.module_el9.7.0+222+ef1c61e1	ALSA-2026:7350
Alpine:v3.21	nghttp2	1.68.1	ALPINE-CVE-2026-27135
Alpine:v3.22	nghttp2	1.68.1	ALPINE-CVE-2026-27135
Alpine:v3.23	nghttp2	1.68.1	ALPINE-CVE-2026-27135
Alpine:v3.24	nghttp2	1.68.1-r0	ALPINE-CVE-2026-27135
Debian:12	nghttp2	1.52.0-1+deb12u3	DEBIAN-CVE-2026-27135
Debian:13	nghttp2	1.64.0-1.1+deb13u1	DEBIAN-CVE-2026-27135
Debian:14	nghttp2	1.68.1-1	DEBIAN-CVE-2026-27135
Rocky Linux:10	nghttp2	0:1.64.0-2.el10_1.1	RLSA-2026:7666
Rocky Linux:8	nghttp2	0:1.33.0-6.el8_10.2	RLSA-2026:7667
Rocky Linux:9	nghttp2	0:1.43.0-6.el9_7.1	RLSA-2026:7668
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.9.0+1760+903d54b9	RLSA-2026:8339
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1666+930e28e8	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.9.0+1760+903d54b9	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1667+4a788d89	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1823+b5789597	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1924+614dc87f	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1988+437f3d23	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1824+532140ee	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1935+d3cbe60f	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1989+e60144d9	RLSA-2026:7123
Rocky Linux:8	nodejs-nodemon	0:3.0.3-1.module+el8.10.0+2084+ab509703	RLSA-2026:7670
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1924+614dc87f	RLSA-2026:8339
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1935+d3cbe60f	RLSA-2026:8339
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1666+930e28e8	RLSA-2026:8339
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1667+4a788d89	RLSA-2026:8339
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1989+e60144d9	RLSA-2026:8339
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1988+437f3d23	RLSA-2026:8339
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1823+b5789597	RLSA-2026:8339
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1824+532140ee	RLSA-2026:8339
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40017+f0db1785	RLSA-2026:7302
Rocky Linux:9	nodejs-nodemon	0:3.0.3-3.module+el9.7.0+40025+0e0cf6b2	RLSA-2026:7350
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40018+a011993d	RLSA-2026:7302
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40018+a011993d	RLSA-2026:7896
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40022+9ecc286c	RLSA-2026:7896
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40017+f0db1785	RLSA-2026:7896
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40022+9ecc286c	RLSA-2026:7302
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:7123
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:8339
Rocky Linux:8	nodejs-packaging	0:2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:7670
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:7302
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:7350
Rocky Linux:9	nodejs-packaging	0:2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:7896
Rocky Linux:10	nodejs22	1:22.22.2-1.el10_1	RLSA-2026:7080
Rocky Linux:10	nodejs24	1:24.14.1-2.el10_1	RLSA-2026:7675
Ubuntu:22.04:LTS	nghttp2	1.43.0-1ubuntu0.3	UBUNTU-CVE-2026-27135
Ubuntu:24.04:LTS	nghttp2	1.59.0-1ubuntu0.3	UBUNTU-CVE-2026-27135
Ubuntu:25.10	nghttp2	1.64.0-1.1ubuntu1.1	UBUNTU-CVE-2026-27135
Ubuntu:26.04:LTS	nghttp2	1.68.0-2ubuntu0.1	UBUNTU-CVE-2026-27135

Affected products (as reported)

Vendor	Product	Versions
nghttp2	nghttp2	< 1.68.1

Weakness: CWE-617 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6 x_refsource_CONFIRM
https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 x_refsource_MISC
http://www.openwall.com/lists/oss-security/2026/03/20/3
https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html
https://access.redhat.com/security/cve/CVE-2026-27135 vdb-entry, x_refsource_REDHAT
RHBZ#2448754 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:27200 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21695 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13812 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21690 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:15087 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:14773 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20087 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17596 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21656 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20040 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8868 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7310 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7666 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7080 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7675 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8339 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7123 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7670 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9711 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:9874 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7983 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7896 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7302 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7350 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:7667 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8541 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8539 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8538 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8540 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8546 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8545 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8547 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:8548 vendor-advisory, x_refsource_REDHAT