CVE-2026-21714: 
npm vulnerability analysis and mitigation

CVE-2026-21714 is a memory leak vulnerability in Node.js HTTP/2 servers classified as Medium severity. It occurs when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1; the server correctly sends a GOAWAY frame but fails to clean up the Http2Session object, leading to resource exhaustion. It affects Node.js versions 20, 22, 24, and 25. The vulnerability was disclosed on March 30, 2026, with patched releases made available on or shortly after March 24, 2026. It carries a CVSS v3.0 base score of 5.3 (Medium) (Node.js Advisory, GitHub Advisory).

The root cause is a missing release of memory after effective lifetime (CWE-401) and missing release of resource after effective lifetime (CWE-772) in Node.js's HTTP/2 session handling code. When a remote client sends crafted WINDOW_UPDATE frames targeting stream 0 that push the connection-level flow control window beyond the RFC-defined maximum of 2³¹-1, the server enters an error state and emits a GOAWAY frame — but the associated Http2Session object is never deallocated. No authentication or special privileges are required; any unauthenticated network client capable of sending HTTP/2 frames can trigger the leak. The vulnerability was reported by galbarnahum and fixed by RafaelGSS (Node.js Advisory).

Repeated exploitation causes gradual memory exhaustion on the affected Node.js server, ultimately resulting in denial of service as the process consumes increasing amounts of heap memory until it becomes unresponsive or crashes. There is no confidentiality or integrity impact — the vulnerability is limited to availability (CVSS availability impact: Low). Services relying on Node.js HTTP/2 endpoints across versions 20, 22, 24, and 25 are at risk, including downstream products such as IBM API Connect (Node.js Advisory, IBM Advisory).

1. Reconnaissance: Identify internet-facing Node.js HTTP/2 servers running versions 20.x (≤20.20.0), 22.x (≤22.22.0), 24.x (≤24.13.x), or 25.x (≤25.8.0) using tools such as Shodan or Censys with HTTP/2 fingerprinting.
2. Establish HTTP/2 connection: Connect to the target server using an HTTP/2-capable client (e.g., curl --http2, h2load, or a custom script using a library such as Python's h2).
3. Send malformed WINDOW_UPDATE frames: Transmit repeated WINDOW_UPDATE frames targeting stream 0 (the connection-level stream) with increment values that cumulatively push the flow control window size above 2³¹-1 (2,147,483,647).
4. Trigger GOAWAY without cleanup: The server detects the protocol violation, sends a GOAWAY frame, but fails to release the Http2Session object from memory — each such connection leaves a leaked object on the heap.
5. Repeat to exhaust memory: Open many such connections in rapid succession or over time to accumulate leaked Http2Session objects, progressively consuming server memory until the process becomes unresponsive or is killed by the OS OOM killer, achieving denial of service (Node.js Advisory).

• Network: High volume of short-lived HTTP/2 connections from one or more source IPs; connections that terminate immediately after the server sends a GOAWAY frame; unusual spikes in HTTP/2 traffic to port 443 or 80.
• Process: Steadily increasing Node.js process memory (RSS/heap) without a corresponding increase in legitimate traffic load; Node.js process eventually killed by OOM killer (dmesg showing Out of memory: Kill process).
• Logs: Repeated HTTP/2 GOAWAY events or protocol error log entries in Node.js application logs; access logs showing many connections with no successful requests from the same client IP.
• System: Elevated memory usage visible in top/htop for the Node.js process; system-level OOM events in /var/log/syslog or /var/log/messages referencing the Node.js PID.

Upgrade Node.js to the following patched versions: 20.20.1 or later, 22.22.1 or later, 24.14.0 or later, or 25.8.1 or later (Node.js Advisory). IBM API Connect users should apply the patches referenced in IBM's advisory (IBM Advisory). As a temporary workaround for services that cannot be immediately patched, consider disabling HTTP/2 support if the application allows it, or implement network-level controls (e.g., rate limiting on HTTP/2 connections, WAF rules) to restrict access to HTTP/2 endpoints from untrusted sources.

The Node.js project disclosed this vulnerability as part of a broader March 2026 security release that addressed nine CVEs across all active release lines, including two high-severity issues, which drew attention from security news outlets (CyberSecurityNews, GBHackers). HeroDevs published a blog post summarizing the March 2026 Node.js security release, noting the breadth of fixes. Linux distribution maintainers (Red Hat, openSUSE, Debian, Rocky Linux, Amazon Linux) issued downstream advisories and updated packages promptly. Community reaction was generally focused on the higher-severity CVEs in the same release batch; CVE-2026-21714 received moderate attention given its Medium rating and lack of active exploitation.