CVE-2026-48937CWE-400denial-of-service

CVE-2026-48937

High · published June 18, 2026

CVSS v3.1

7.5

EPSS

Percentile

46.6

In the wild

Unconfirmed

What it is

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00573 · 46.6th percentile
Weakness: CWE-400 · Uncontrolled Resource Consumption
Published: 2026-06-18T23:16Z

Affected products (2)

Product	Versions	Fixed in
nodejs/node.js	≥ 22.0, < 22.23.0	22.23.0
nodejs/node.js	≥ 24.0.0, < 24.17.0	24.17.0

References (2)

https://hackerone.com/reports/3658225 · [email protected]https://nodejs.org/en/blog/vulnerability/june-2026-security-releases · [email protected]

EPSS history

Timeline

18 JUN 18:01Z
A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame
cvelistv5