CVE-2026-56846: 
Node.js Schwachstellenanalyse und -minderung

CVE-2026-56846 is a high-severity vulnerability in Node.js's HTTP/2 implementation where retained header blocks can bypass maxSessionMemory limits, leading to remote memory exhaustion. It was disclosed on July 29, 2026, as part of Node.js's July 2026 security release batch. The vulnerability affects all users on active release lines 22.x and 24.x. The CVE is estimated as Medium–High severity by Feedly, and the Node.js project classifies it as High (Node.js Advisory).

The root cause is a flaw in Node.js's HTTP/2 session accounting logic, where retained header blocks are not properly tracked against the maxSessionMemory configuration limit. This allows an attacker to send crafted HTTP/2 requests with large or numerous header blocks that accumulate in memory without being counted toward the session memory cap, effectively bypassing the intended resource constraint. The vulnerability is remotely exploitable without authentication, requiring only network access to an HTTP/2-enabled Node.js server. The reporter is credited as leduckhuong, and the fix was authored by mcollina (Node.js Advisory).

Successful exploitation results in remote memory exhaustion on the affected Node.js server, constituting a Denial of Service (DoS) condition. An unauthenticated remote attacker can repeatedly send HTTP/2 requests with retained header blocks to consume server memory beyond configured limits, potentially crashing the process or degrading service availability for all users. Confidentiality and integrity are not directly impacted, but availability is severely affected (Node.js Advisory).

1. Reconnaissance: Identify internet-facing Node.js servers running HTTP/2 on affected release lines (22.x or 24.x prior to patched versions) using tools like Shodan or Censys, filtering for HTTP/2-capable endpoints.
2. Establish HTTP/2 connection: Initiate an HTTP/2 connection to the target server, which is required for the vulnerability to be triggered.
3. Send crafted requests with large/numerous header blocks: Transmit HTTP/2 requests containing large or numerous header fields (e.g., via HEADERS frames) designed to be retained in session state without being counted against maxSessionMemory.
4. Repeat to exhaust memory: Continuously send such requests across one or multiple sessions to accumulate retained header memory, bypassing the server's configured memory cap.
5. Achieve DoS: The server's memory is exhausted, causing process instability, crashes, or severe degradation of service for legitimate users (Node.js Advisory).

• Network: Unusually high volume of HTTP/2 HEADERS frames from a single or small set of source IPs; connections with abnormally large or numerous header fields targeting Node.js HTTP/2 endpoints.
• Process: Node.js process memory usage growing continuously beyond expected bounds; process crashes or OOM (out-of-memory) kills on HTTP/2-serving Node.js instances.
• Logs: Node.js application logs showing repeated HTTP/2 session establishment followed by memory-related errors or abrupt terminations; system logs (e.g., dmesg, journalctl) recording OOM killer events targeting the Node.js process.

The Node.js project released patched versions on July 29, 2026: v22.23.2 (for the 22.x line) and v24.18.1 (for the 24.x line). Users should upgrade to these versions immediately. As a temporary workaround, operators may consider disabling HTTP/2 support if not required, or placing a reverse proxy (e.g., nginx) in front of Node.js to enforce stricter HTTP/2 header limits. End-of-Life Node.js versions are also affected and should be migrated to a supported release line (Node.js Advisory, Node.js v22.23.2 Release, Node.js v24.18.1 Release).

The July 2026 Node.js security release, which includes CVE-2026-56846, received coverage from multiple security news outlets including CyberSecurityNews, CyberPress, and SecurityOnline, noting that Node.js fixed 11 security flaws capable of crashing servers and breaking filesystem restrictions. The Linux-compatible community highlighted the emergency nature of the patch batch. No notable individual researcher commentary or significant social media controversy has been identified beyond standard patch notification discussions (CyberSecurityNews, SecurityOnline).