{"id":"CVE-2026-21714","title":"A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1","summary":"A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, bu…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-401"],"vendor":"nodejs","product":"node.js","affected":["node.js <= 20.20.1","node.js >= 22.0.0, <= 22.22.1","node.js >= 24.0.0, <= 24.14.0","node.js >= 25.0.0, <= 25.8.1"],"published":"2026-03-30","updated":"2026-08-19","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-21714","references":[{"url":"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases","label":"support@hackerone.com"}],"tags":["nvd"],"epss":0.00454,"epssPercentile":0.38602,"ingestedAt":"2026-08-19T13:39:32.812Z","slug":"CVE-2026-21714","body":"## Overview\n\nA memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\r\n\r\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.\n\n## Affected\n\n- `node.js <= 20.20.1`\n- `node.js >= 22.0.0, <= 22.22.1`\n- `node.js >= 24.0.0, <= 24.14.0`\n- `node.js >= 25.0.0, <= 25.8.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}