CVE-2026-48937

CVSS 5.3 MEDIUMEPSS 0.4%CWE-400

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame. This vulnerability affects two supported release lines: **Node.js 22** and **Node.js 24**.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Produtos afetados

nodejs · node

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://hackerone.com/reports/3658225 https://nodejs.org/en/blog/vulnerability/june-2026-security-releases