Node.js · Report #3676863
Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames
Validstatus
mediumseverity
4upvotes
25 Jun 2026disclosed
Summary
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.