CVE-2026-27135: 
npm vulnerability analysis and mitigation

CVE-2026-27135 is a Denial of Service vulnerability in the nghttp2 HTTP/2 library (C implementation) caused by a reachable assertion failure due to missing internal state validation. It affects all nghttp2 versions up to and including 1.68.0, with the fix introduced in version 1.68.1. The vulnerability was disclosed on March 18, 2026, by researcher @AndrewMohawk and the nghttp2 development team. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-617 (Reachable Assertion). When nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called — either by the application or internally by the library upon detecting a connection error — the library fails to validate the internal iframe->state field. As a result, the library continues reading incoming data even after session termination has been initiated. If a subsequent malformed HTTP/2 frame triggering a FRAME_SIZE_ERROR is received in this state, an assertion failure occurs and the process crashes. Specific vulnerable execution paths include processing of ALTSVC (RFC 7838), PRIORITY_UPDATE, and user-defined extension frames; ALTSVC and PRIORITY_UPDATE must be explicitly enabled via nghttp2_option_set_builtin_recv_extension_type, and user-defined extension frames via nghttp2_option_set_user_recv_extension_type. The fix (commit 5c7df8f) adds iframe->state == NGHTTP2_IB_IGN_ALL checks at multiple points in nghttp2_session_mem_recv2() to return early when the session is being terminated (GitHub Advisory, Patch Commit).

Successful exploitation causes an assertion failure that crashes the process hosting the nghttp2 library, resulting in a complete loss of availability for the affected HTTP/2 service. There is no confidentiality or integrity impact — the vulnerability is purely a Denial of Service. The attack is network-accessible, requires no authentication, no privileges, and no user interaction, making any exposed HTTP/2 endpoint potentially vulnerable. Downstream software bundling nghttp2 — including Node.js, CMake, IBM Instana, IBM App Connect Enterprise, IBM MQ, and Microsoft Azure Linux packages — is also affected (GitHub Advisory, IBM Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.013% (0.000130), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by @AndrewMohawk, with additional attack paths identified by the nghttp2 development team. Detection signatures are available in Nessus and Qualys scanners (Red Hat CVE).

1. Reconnaissance: Identify HTTP/2-enabled services running software that bundles nghttp2 < 1.68.1 (e.g., Node.js, nginx with nghttp2, or custom C/C++ applications). Tools like Shodan or Censys can be used to find internet-facing HTTP/2 endpoints.
2. Trigger session termination: Send a valid HTTP/2 request that causes the server to invoke nghttp2_session_terminate_session internally — for example, by sending a malformed ALTSVC frame (if ALTSVC extension is enabled) or a malformed PRIORITY_UPDATE frame with stream_id == 0.
3. Send malformed frame: Immediately after triggering session termination, send a crafted HTTP/2 frame that causes a FRAME_SIZE_ERROR (e.g., a frame with an incorrect length field). Due to the missing state validation, the library continues processing this frame instead of ignoring it.
4. Achieve crash: The assertion failure is triggered in nghttp2_session_mem_recv2(), causing the process to abort and the HTTP/2 service to crash, resulting in denial of service (GitHub Advisory, oss-security).

• Logs: Unexpected process crash or abort signals (SIGABRT) in application logs or system logs (e.g., /var/log/syslog, journald) from the HTTP/2 service process; assertion failure messages referencing nghttp2_session.c or iframe->state.
• Network: Unusual HTTP/2 traffic sequences where a connection sends ALTSVC, PRIORITY_UPDATE, or extension frames followed immediately by a frame with an invalid length; repeated short-lived HTTP/2 connections from the same source IP.
• Process: Unexpected termination or restart of services using nghttp2 (e.g., Node.js, nginx); core dump files generated by the service process in the working directory or /var/crash/.
• System: Increased service restart counts in process supervisors (systemd, supervisord) for HTTP/2-serving processes without corresponding application-level errors.

The primary and only remediation is to upgrade nghttp2 to version 1.68.1 or later, which adds the missing iframe->state validation checks. No workarounds are available. Organizations should prioritize updating all software that bundles nghttp2, including Node.js distributions, CMake, IBM Instana Observability, IBM App Connect Enterprise Certified Container, and IBM MQ container images. Vendor-specific patches are available from Red Hat (multiple RHSA advisories), SUSE, Ubuntu, Debian, Amazon Linux, and IBM (GitHub Advisory, Red Hat CVE, IBM Advisory).

The vulnerability was disclosed via the nghttp2 project's GitHub Security Advisories and cross-posted to the oss-security mailing list on March 20, 2026, by Alan Coopersmith (oss-security). Microsoft, Red Hat, IBM, SUSE, Ubuntu, Debian, and Amazon Linux all issued security advisories and patches in the weeks following disclosure, reflecting broad industry recognition of the vulnerability's impact on the HTTP/2 ecosystem. Community reaction has been measured, consistent with a DoS-only vulnerability with no known active exploitation.