p PatchFirst

CVE-2026-21714

CVE-2026-21714

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up. This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

CVSS 5.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • node.js

    Versions
    • ≥ 20.20.1, ≤ 20.20.1: Affected (semver)
    • ≥ 22.22.1, ≤ 22.22.1: Affected (semver)
    • ≥ 24.14.0, ≤ 24.14.0: Affected (semver)
    • ≥ 25.8.1, ≤ 25.8.1: Affected (semver)

    No fix published

  • nodejs Debian:12

    Versions
    • 18.13.0+dfsg1-1
    • 18.13.0+dfsg1-1.1
    • 18.19.0+dfsg-1
    • 18.19.0+dfsg-2
    • 18.19.0+dfsg-3
    • 18.19.0+dfsg-4
    • 18.19.0+dfsg-5
    • 18.19.0+dfsg-6
    • 18.19.0+dfsg-6~deb12u1
    • 18.19.0+dfsg-6~deb12u2
    • 18.19.1+dfsg-1
    • 18.19.1+dfsg-2
    • 18.19.1+dfsg-3
    • 18.19.1+dfsg-3.1
    • 18.19.1+dfsg-4
    • 18.19.1+dfsg-6
    • 18.20.1+dfsg-1
    • 18.20.1+dfsg-2
    • 18.20.1+dfsg-3
    • 18.20.1+dfsg-4
    • 18.20.4+dfsg-1~deb12u1
    Affected ranges
    • ECOSYSTEM: < 18.20.4+dfsg-1~deb12u2

    Update to 18.20.4+dfsg-1~deb12u2

  • nodejs Debian:13

    Versions
    • 20.19.2+dfsg-1
    • 20.19.2+dfsg-1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 20.19.2+dfsg-1+deb13u2

    Update to 20.19.2+dfsg-1+deb13u2

  • nodejs Debian:14

    Versions
    • 20.19.2+dfsg-1
    • 20.19.4+dfsg-1
    • 20.19.5+dfsg+~cs20.19.12-1
    • 20.19.5+dfsg+~cs20.19.12-2
    • 20.19.5+dfsg+~cs20.19.12-3
    • 20.19.5+dfsg+~cs20.19.12-4
    • 20.19.5+dfsg+~cs20.19.24-1
    • 22.12.0+dfsg-1
    • 22.12.0+dfsg-2
    • 22.12.0+dfsg-3
    • 22.14.0+dfsg-1
    • 22.18.0+dfsg+~cs22.17.2-1
    • 22.18.0+dfsg+~cs22.17.2-2
    • 22.18.0+dfsg-1
    • 22.19.0+dfsg+~cs22.18.0-1
    • 22.21.1+dfsg+~cs22.19.0-1
    • 22.21.1+dfsg+~cs22.19.0-2
    • 22.21.1+dfsg+~cs22.19.0-3
    • 22.21.1+dfsg+~cs22.19.0-4
    • 22.21.1+dfsg+~cs22.19.0-5
    • 22.21.1+dfsg+~cs22.19.0-6
    • 22.22.0+dfsg+~cs22.19.13-1
    • 22.22.0+dfsg+~cs22.19.13-2
    • 22.22.0+dfsg+~cs22.19.6-1
    • 22.22.1+dfsg+~cs22.19.15-1
    Affected ranges
    • ECOSYSTEM: < 22.22.2+dfsg+~cs22.19.15-1

    Update to 22.22.2+dfsg+~cs22.19.15-1

  • nodejs Ubuntu:Pro:14.04:LTS

    Versions
    • 0.10.15~dfsg1-4
    • 0.10.21~dfsg1-1
    • 0.10.22~dfsg1-2
    • 0.10.23~dfsg1-1
    • 0.10.23~dfsg1-2
    • 0.10.23~dfsg1-3
    • 0.10.24~dfsg1-1
    • 0.10.25~dfsg2-2
    • 0.10.25~dfsg2-2ubuntu1
    • 0.10.25~dfsg2-2ubuntu1.2
    • 0.10.25~dfsg2-2ubuntu1.2+esm1
    • 0.10.25~dfsg2-2ubuntu1.2+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nodejs Ubuntu:Pro:16.04:LTS

    Versions
    • 0.10.25~dfsg2-2ubuntu1
    • 4.2.2~dfsg-1
    • 4.2.3~dfsg-1
    • 4.2.4~dfsg-1ubuntu1
    • 4.2.4~dfsg-2
    • 4.2.6~dfsg-1ubuntu1
    • 4.2.6~dfsg-1ubuntu4
    • 4.2.6~dfsg-1ubuntu4.1
    • 4.2.6~dfsg-1ubuntu4.2
    • 4.2.6~dfsg-1ubuntu4.2+esm1
    • 4.2.6~dfsg-1ubuntu4.2+esm2
    • 4.2.6~dfsg-1ubuntu4.2+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nodejs Ubuntu:Pro:18.04:LTS

    Versions
    • 6.11.4~dfsg-1ubuntu1
    • 6.11.4~dfsg-1ubuntu2
    • 6.12.0~dfsg-1ubuntu1
    • 6.12.0~dfsg-2ubuntu1
    • 6.12.0~dfsg-2ubuntu2
    • 8.10.0~dfsg-2
    • 8.10.0~dfsg-2ubuntu0.2
    • 8.10.0~dfsg-2ubuntu0.3
    • 8.10.0~dfsg-2ubuntu0.4
    • 8.10.0~dfsg-2ubuntu0.4+esm1
    • 8.10.0~dfsg-2ubuntu0.4+esm2
    • 8.10.0~dfsg-2ubuntu0.4+esm3
    • 8.10.0~dfsg-2ubuntu0.4+esm4
    • 8.10.0~dfsg-2ubuntu0.4+esm5
    • 8.10.0~dfsg-2ubuntu0.4+esm6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nodejs Ubuntu:Pro:20.04:LTS

    Versions
    • 10.15.2~dfsg-2ubuntu1
    • 10.17.0~dfsg-2ubuntu4
    • 10.17.0~dfsg-2ubuntu6
    • 10.19.0~dfsg-3ubuntu1
    • 10.19.0~dfsg-3ubuntu1.1
    • 10.19.0~dfsg-3ubuntu1.2
    • 10.19.0~dfsg-3ubuntu1.3
    • 10.19.0~dfsg-3ubuntu1.5
    • 10.19.0~dfsg-3ubuntu1.6
    • 10.19.0~dfsg-3ubuntu1.6+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nodejs Ubuntu:Pro:22.04:LTS

    Versions
    • 12.22.5~dfsg-5ubuntu1
    • 12.22.7~dfsg-2ubuntu1
    • 12.22.7~dfsg-2ubuntu3
    • 12.22.9~dfsg-1ubuntu2
    • 12.22.9~dfsg-1ubuntu3
    • 12.22.9~dfsg-1ubuntu3.1
    • 12.22.9~dfsg-1ubuntu3.2
    • 12.22.9~dfsg-1ubuntu3.3
    • 12.22.9~dfsg-1ubuntu3.4
    • 12.22.9~dfsg-1ubuntu3.5
    • 12.22.9~dfsg-1ubuntu3.6
    • 12.22.9~dfsg-1ubuntu3.6+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nodejs Ubuntu:24.04:LTS

    Versions
    • 18.13.0+dfsg1-1ubuntu2
    • 18.19.1+dfsg-2ubuntu4
    • 18.19.1+dfsg-6ubuntu1
    • 18.19.1+dfsg-6ubuntu2
    • 18.19.1+dfsg-6ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nodejs Ubuntu:25.10

    Versions
    • 20.18.1+dfsg-1ubuntu2
    • 20.19.2+dfsg-1
    • 20.19.4+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nodejs Ubuntu:26.10

    Versions
    • 22.22.1+dfsg+~cs22.19.15-1ubuntu1
    • 24.16.0+dfsg+~cs24.13.1-2ubuntu1
    • 24.18.0+dfsg+~cs24.13.2-1ubuntu1
    • 24.19.0+dfsg+~cs24.13.3-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nodejs Ubuntu:26.04:LTS

    Versions
    • 20.19.4+dfsg-1
    • 20.19.5+dfsg+~cs20.19.12-4
    • 22.21.1+dfsg+~cs22.19.0-6ubuntu4
    • 22.22.0+dfsg+~cs22.19.6-1ubuntu2
    • 22.22.0+dfsg+~cs22.19.13-2ubuntu1
    • 22.22.1+dfsg+~cs22.19.15-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →