CVE-2026-48937

Details

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24.

Affected Packages

Node.js

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

References

WEB

https://hackerone.com/reports/3658225

WEB

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-48937