CVE-2026-123828 Node.js is vulnerable to a heap buffer overflow in HTTP/2 session.altsvc() via a long origin
Remote attackers can send a long :authority header to Node.js HTTP/2 apps passing it to Alt-Svc, corrupting heap memory and crashing the process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Harmful if only installed
- No
- Needs a specific call
- Yes
- Fix
- Available
What is CVE-2026-123828?
CVE-2026-123828 is a medium-severity memory corruption vulnerability in nodejs node, published on 11 Nov 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt process memory. When an application passes an attacker-controlled value such as a request's :authority header to Http2Session.altsvc(), the AltSvc implementation in src/node_http2.cc allocates a buffer sized to the origin length and then writes it with a null terminator, placing one byte past the end of the allocation. A single request carrying a long but syntactically valid :authority triggers the out-of-bounds write, which aborts the process and serves as a remote heap-corruption primitive. This vulnerability affects Node.js 26.x and 24.x.
Weakness: CWE-122
Which versions are affected by CVE-2026-123828?
An affected version is only exploitable if your software calls Http2Session.altsvc(). Many projects that include it are not exposed.
How do I fix CVE-2026-123828?
No fix published yet.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-123828 being exploited?
There is no known exploitation of CVE-2026-123828 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-123828, BELL-CVE-2026-123828, DEBIAN-CVE-2026-123828, GHSA-5pfh-35r8-498j, UBUNTU-CVE-2026-123828.