CVE-2026-48937(nodejs / node.js)

LOWCVSS 7.5 · HIGH

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.

nodejs CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

Vendor / third-party advisories

https://hackerone.com/reports/3658225

Weakness type (CWE)

CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

node.js

Affected systems

Vendors

nodejs

Products

node.js

Deep dive

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nodejs	node.js	-	-	-

Explore more

Back to dashboard nodejs CVEs node.js vulnerabilities