Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-30 | 2 | Disclosure1Patch1 |
| 2026-08-03 | 1 | Patch1 |
| 2026-08-04 | 2 | General2 |
| 2026-08-07 | 1 | Disclosure1 |
| 2026-09-02 | 1 | General1 |
| 2026-10-04 | 1 | Disclosure1 |
CVE-2026-56846, CVE-2026-56848 & CVE-2026-58043 and other: 3 high-severity and 8 medium or low vulnerabilities in Node.js 🔥 Recently disclosed vulnerabilities in Node.js touch HTTP/2, the Permission Model, and several core modules. 👉 https://nt.ls/AAg1f
Post summary
Three high‑severity and eight medium/low Node.js vulnerabilities were just disclosed, impacting HTTP/2, the permission model, and core modules.
CVE-2026-56846: Node.js HTTP/2 Memory Exhaustion Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04wr5Cz0
Post summary
The excerpt only cites the CVE‑2026‑56846 name and an article title, providing no actionable or technical information whatsoever.
Node.js の 11件の脆弱性が FIX：不正なファイル・システム・アクセスやメモリ破壊の恐れ https://iototsecnews.jp/2026/07/30/node-js-fixes-11-security-flaws-that-can-crash-servers-and-break-filesystem-restrictions/ Node.js において、HTTP/2 処理や実行権限管理の不備に起因する複数の脆弱性 CVE-2026-56846／CVE-2026-56848／CVE-2026-58043 などが公表されました。この問題は、通信処理時のメモリ制限回避や、データ解放後の不正アクセス、アクセス許可領域の誤判定などに起因しています。悪用された場合には、サーバ・メモリの枯渇によるサービス停止や、意図しないファイル読み書き、システム・クラッシュが引き起こされる恐れがあります。対応策として、修正パッチが適用された最新バージョンへの速やかな移行や、本番環境での動作検証が有効です。システムを安全に利用するためにも、依存ライブラリを含めた環境のアップデートを実施することが推奨されます。 #CVE202656846 #CVE202656847 #CVE202656848 #CVE202656850 #CVE202658039 #CVE202658040 #CVE202658041 #CVE202658042 #CVE202658043 #CVE202658044 #CVE202658045 #Node.js #Vulnerability
Post summary
Node.js 11 critical vulnerabilities, including CVE‑2026‑56846, CVE‑2026‑56848, and CVE‑2026‑58043, have been disclosed with detailed technical impact; patches are available and updates are strongly recommended.
Recent Key Vulnerabilities Affecting Node.js 20 Prior to and surrounding its EOL timeline, several critical security issues were identified that impact the Node.js 20.x runtime line:😁 • HTTP/2 RST_STREAM Heap Use-After-Free (CVE-2026-56848): A High severity flaw where a remote, unauthenticated attacker can trigger a process crash. The HTTP/2 server can force a stream write that re-enters session memory allocation while it is still processing received frames, resulting in an availability denial-of-service (DoS). • Permission Model Radix-Tree Over-Grant (CVE-2026-58043): A High severity issue where a flaw in prefix boundary handling allows an attacker with partial filesystem access to read or write to paths completely outside the intended restricted allowlist. • HTTP/2 Resource Exhaustion (CVE-2026-56846): A High severity memory flaw where retained header blocks escape the maxSessionMemory limit, allowing a remote client to consume all process memory and force a crash. • Bypass File System Permissions via Symlinks (CVE-2025-55130): A High severity flaw in the Permissions model where path restrictions (--allow-fs-read and --allow-fs-write) can be escaped using relative symbolic links, enabling unauthorized system file access. • TLS Callback Exceptions DoS (CVE-2026-21637): A Medium severity bug where synchronous exceptions thrown inside pskCallback or ALPNCallback bypass standard TLS error paths, causing file descriptor leaks or sudden process termination.
Post summary
The text discloses multiple CVEs affecting Node.js 20.x with technical descriptions and severity ratings, but contains no indicators of PoCs, exploits, active exploitation, or remediation actions.
⚠️ Vulnerabilidad en productos Node.js ❗ CVE-2026-56846 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-node-js/ https://t.co/qpIldESmbR
Post summary
El mensaje anuncia un CVE para productos Node.js y proporciona enlaces para más información, pero no ofrece detalles técnicos, PoC, herramientas de explotación, o indicios de explotación activa.
CVE-2026-56846 Remote Memory Exhaustion via HTTP/2 Retained Header Blocks in Nod... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-56846 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The text alerts readers to CVE-2026‑56846, a remote memory exhaustion issue tied to HTTP/2 header processing, and directs them to an external site for further details.
Node.js 2026年7月のパッチで11件の脆弱性を修正(CVE-2026-56846,CVE-2026-56848)等 https://rocket-boys.co.jp/security-measures-lab/nodejs-july-2026-security-patch-11-vulnerabilities-fixed/ #セキュリティ対策Lab #security #securitynews #脆弱性
Post summary
Node.js released a July 2026 patch that fixes 11 vulnerabilities, including CVE-2026-56846 and CVE-2026-56848, as announced in the linked article.
Node.js has patched 11 security flaws across its 22.x, 24.x, and 26.x release lines, with patched versions 22.23.2, 24.18.1, and 26.5.1 released July 29. Top high-severity issues include an HTTP/2 memory exhaustion bug (CVE-2026-56846), a use-after-free flaw in HTTP/2 processing (CVE-2026-56848), and a Permission Model bypass (CVE-2026-58043) letting attackers escape restricted filesystem paths. 🔵 Also fixed: TLS identity leakage across cert configs, incomplete hostname verification, and an HTTP request smuggling risk via header truncation 🔵 Upgrade immediately — EOL versions remain unpatched and exposed
Post summary
Node.js announces patches for 11 high‑severity vulnerabilities, detailing CVE IDs and effects, and urges users to upgrade to the latest versions.