CVE-2026-56846: 
npm vulnerability analysis and mitigation

CVE-2026-56846 is a high-severity denial-of-service vulnerability in Node.js HTTP/2 handling, where retained header blocks can evade maxSessionMemory limits and enable remote memory exhaustion. It was reported by researcher leduckhuong, fixed by mcollina, and publicly disclosed on July 29, 2026 as part of Node.js's July 2026 security release. Affected versions include Node.js 24.x (up to and including 24.18.0) and 22.x (up to and including 22.23.1). It carries a CVSS v3.0 base score of 7.5 (High) (Node.js Advisory, GitHub Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption): Node.js's HTTP/2 implementation fails to properly account for retained header blocks when enforcing the maxSessionMemory limit, allowing memory to grow unboundedly. An unauthenticated remote attacker can send specially crafted HTTP/2 requests that cause the server to accumulate header block memory without triggering the configured session memory cap. No authentication, user interaction, or special privileges are required for exploitation, and the attack complexity is low. No public proof-of-concept code has been identified at this time (Node.js Advisory, GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in remote memory exhaustion of the Node.js process, causing service unavailability (denial of service). There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. Any Node.js application serving HTTP/2 traffic on the 22.x or 24.x release lines is at risk, and repeated exploitation can keep a service continuously unavailable without attacker authentication (Node.js Advisory, GitHub Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation as of the time of disclosure. The NVD SSVC assessment confirms no known exploitation and classifies the technical impact as partial, though the attack is automatable. The EPSS score is approximately 0.55–0.62%, placing it in roughly the 47th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Node.js Advisory).

1. Reconnaissance: Identify internet-facing Node.js servers running HTTP/2 on versions 22.x ≤ 22.23.1 or 24.x ≤ 24.18.0 using tools like Shodan or Censys, filtering for HTTP/2-enabled services.
2. Establish HTTP/2 connection: Initiate an HTTP/2 connection to the target server. HTTP/2 is typically served over TLS (h2) or cleartext (h2c) depending on server configuration.
3. Send crafted requests with large/numerous header blocks: Transmit a high volume of HTTP/2 requests containing large or numerous HPACK-encoded header blocks. The flaw causes these retained header blocks to accumulate in server memory without being counted against the maxSessionMemory limit.
4. Sustain the attack: Continue sending requests to prevent memory from being freed, progressively exhausting the Node.js process's available heap memory.
5. Achieve denial of service: The Node.js process runs out of memory, causing it to crash or become unresponsive, resulting in service unavailability for legitimate users (Node.js Advisory, GitHub Advisory).

• Network: Unusually high volume of HTTP/2 connections or requests from a single or small set of source IPs; large numbers of HTTP/2 HEADERS frames with oversized or numerous header blocks observed in network captures.
• Process/System: Rapidly increasing memory consumption of the Node.js process (observable via top, htop, or process monitoring tools); out-of-memory (OOM) kills of the Node.js process in system logs (/var/log/syslog, dmesg, or journalctl).
• Logs: Node.js application logs showing sudden crashes or restarts; HTTP/2 session errors or memory-related error messages in application output; high request rates from specific clients in access logs targeting HTTP/2 endpoints.

Upgrade Node.js to a patched release: v22.23.2 or v24.18.1 (or later), which include the fix authored by mcollina. As a temporary network-level workaround, implement rate limiting on HTTP/2 connections and requests at a reverse proxy or load balancer (e.g., nginx, HAProxy) to reduce the attack surface. Monitor Node.js process memory usage on HTTP/2-serving instances for anomalous growth. SUSE, openSUSE, and Amazon Linux 2023 have also issued updated packages for their distributions (Node.js Advisory, GitHub Advisory, Red Hat Bugzilla).

The Node.js project credited researcher leduckhuong for the discovery and mcollina for the fix in its official July 2026 security advisory. Security news outlets including CyberSecurityNews, SecurityOnline, and CyberPress covered the broader July 2026 Node.js security release, which addressed 11 CVEs across active release lines. The release was described as an emergency security patch by some outlets. No significant controversy or notable researcher commentary specific to CVE-2026-56846 beyond standard patch reporting has been observed (Node.js Advisory, SecurityOnline).