{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-123863", "tracking": { "current_release_date": "2026-11-13T01:00:27.317408Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-123863", "initial_release_date": "2026-11-11T18:39:01.859045Z", "revision_history": [ { "date": "2026-11-11T18:39:01.859045Z", "number": "1", "summary": "CWES created (1).| Products created (2).| References created (2).| Description created for source.| Unknown change." }, { "date": "2026-11-11T18:39:07.483541Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-11-11T19:32:07.222432Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-11-11T19:32:08.965832Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-11-12T00:27:56.648907Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (6).| Product Identifiers created (1).| Product Remediations created (6).| References created (4).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-11-12T00:28:06.944956Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-11-12T02:41:47.499795Z", "number": "7", "summary": "Source connected.| CVE status created. (valid)" }, { "date": "2026-11-12T06:44:36.413115Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)." }, { "date": "2026-11-12T06:44:37.738699Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-11-12T12:02:31.791875Z", "number": "10", "summary": "CVSS created.| Products created (4).| References created (1).| Description created for source.| Unknown change." }, { "date": "2026-11-12T12:19:47.577587Z", "number": "11", "summary": "Source connected.| CVE status created. (valid)| Products connected (3).| References created (3)." }, { "date": "2026-11-12T12:19:49.501397Z", "number": "12", "summary": "NCSC Score updated." }, { "date": "2026-11-12T14:20:18.897978Z", "number": "13", "summary": "Source connected.| CVE status created. (valid)" }, { "date": "2026-11-12T16:16:58.547872Z", "number": "14", "summary": "EPSS created.| Unknown change." }, { "date": "2026-11-12T16:19:42.004695Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-11-13T00:03:08.419915Z", "number": "16", "summary": "Products created (1)." } ], "status": "interim", "version": "16" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<22.23.5", "product": { "name": "vers:unknown/<22.23.5", "product_id": "CSAFPID-10088842" } }, { "category": "product_version_range", "name": "vers:unknown/<24.22.3", "product": { "name": "vers:unknown/<24.22.3", "product_id": "CSAFPID-10088840" } }, { "category": "product_version_range", "name": "vers:unknown/<26.13.1", "product": { "name": "vers:unknown/<26.13.1", "product_id": "CSAFPID-10088841" } } ], "category": "product_name", "name": "Node.js" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-6014972", "product_identification_helper": { "cpe": "cpe:/a:redhat:hummingbird:1" } } } ], "category": "product_name", "name": "Red Hat Hardened Images" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8505503" } } ], "category": "product_name", "name": "nodejs20" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8505504" } } ], "category": "product_name", "name": "nodejs22" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8476917" } } ], "category": "product_name", "name": "nodejs24" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-6239276" } } ], "category": "product_name", "name": "nodejs25" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8476920" } } ], "category": "product_name", "name": "nodejs26" } ], "category": "product_family", "name": "Red Hat Hardened Images" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<22.23.5-r0", "product": { "name": "vers:unknown/>=0|<22.23.5-r0", "product_id": "CSAFPID-10088332" } } ], "category": "product_name", "name": "nodejs" } ], "category": "product_family", "name": "Alpine:v3.21" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<22.23.5-r0", "product": { "name": "vers:unknown/>=0|<22.23.5-r0", "product_id": "CSAFPID-10088333" } } ], "category": "product_name", "name": "nodejs" } ], "category": "product_family", "name": "Alpine:v3.22" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<24.22.3-r0", "product": { "name": "vers:unknown/>=0|<24.22.3-r0", "product_id": "CSAFPID-10088334" } } ], "category": "product_name", "name": "nodejs" } ], "category": "product_family", "name": "Alpine:v3.23" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<24.22.3-r0", "product": { "name": "vers:unknown/>=0|<24.22.3-r0", "product_id": "CSAFPID-10088335" } } ], "category": "product_name", "name": "nodejs" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<26.13.1-r0", "product": { "name": "vers:unknown/>=0|<26.13.1-r0", "product_id": "CSAFPID-10092238" } } ], "category": "product_name", "name": "nodejs-current" } ], "category": "product_family", "name": "Alpine:v3.24" } ], "category": "vendor", "name": "Alpine" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-1408881" } } ], "category": "product_name", "name": "nodejs" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/24.0.0|<24.22.3", "product": { "name": "vers:semver/24.0.0|<24.22.3", "product_id": "CSAFPID-10084444" } }, { "category": "product_version_range", "name": "vers:semver/25.0.0|<26.13.1", "product": { "name": "vers:semver/25.0.0|<26.13.1", "product_id": "CSAFPID-10084445" } } ], "category": "product_name", "name": "nodejs" } ], "category": "vendor", "name": "nodejs" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-123863", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "notes": [ { "category": "description", "text": "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-123863" }, { "category": "description", "text": "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-123863" }, { "category": "description", "text": "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).", "title": "osvalpine - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Alpine%2FALPINE-CVE-2026-123863.json?alt=media" }, { "category": "description", "text": "A flaw was found in Node.js. An unauthenticated remote attacker can cause a Denial of Service (DoS) by triggering an abnormal server crash during HTTP/2 session termination. By sending a request where the server responds before the request body has finished transmitting, an individual stream can outlive its parent session while retaining allocated memory. This inconsistency triggers an internal check failure during session cleanup, immediately terminating the server process.\nThis vulnerability is rated as Important severity because an unauthenticated remote attacker can trigger an unexpected server crash, causing a full denial of service without requiring authentication or user interaction. In Red Hat environments, the impact directly affects deployments hosting Node.js applications that utilize the built-in HTTP/2 server module exposed to untrusted network traffic. Applications serving requests exclusively over HTTP/1.1 or situated behind reverse proxies that terminate HTTP/2 traffic are not exposed to this failure path.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-123863" }, { "category": "description", "text": "A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A client can arrange for an Http2Stream that still holds nghttp2-allocated header buffers to outlive its session: the stream is removed from the session's stream set but never detached, so when ~Http2Session() runs the memory accounting is nonzero and the CHECK_EQ(current_nghttp2_memory_, 0) assertion fails, terminating the process. The trigger needs only a default http2 server whose handler responds before the request body has ended, which is typical. It is a variant of CVE-2024-27983 that the earlier fix did not cover, because that fix only detached streams still tracked in the session. This vulnerability affects Node.js 26.x (since 26.9.0) and 24.x (since 24.22.0).", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-123863" }, { "category": "other", "text": "0.00461", "title": "EPSS" }, { "category": "other", "text": "3.7", "title": "NCSC Score" }, { "category": "other", "text": "There is product data available from source Certbundde", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "Is related to a product by vendor Open Source, The CVSS vector string contains A:H (Availability Impact: High), There is cwe data available from source Nvd, There is product data available from source Debian", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 3\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-10084444", "CSAFPID-10084445", "CSAFPID-6014972", "CSAFPID-6239276", "CSAFPID-8476917", "CSAFPID-8476920", "CSAFPID-8505503", "CSAFPID-8505504", "CSAFPID-1408881", "CSAFPID-10088332", "CSAFPID-10088333", "CSAFPID-10088334", "CSAFPID-10088335", "CSAFPID-10088840", "CSAFPID-10088841", "CSAFPID-10088842", "CSAFPID-10092238" ] }, "references": [ { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-123863" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-123863" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123863" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-123863" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-123863" }, { "category": "external", "summary": "Source - hkcert", "url": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20261112" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Alpine%2FALPINE-CVE-2026-123863.json?alt=media" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4525.json" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0492" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4525.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4525" }, { "category": "external", "summary": "Reference - certbundde; cveprojectv5; nvd; redhat", "url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; redhat", "url": "https://cna.openjsf.org/security-advisories.html" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-123863" }, { "category": "external", "summary": "Reference - redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123863" }, { "category": "external", "summary": "Reference - osv", "url": "https://security.alpinelinux.org/vuln/CVE-2026-123863" } ], "remediations": [ { "category": "mitigation", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "CSAFPID-6014972", "CSAFPID-6239276", "CSAFPID-8476917", "CSAFPID-8476920", "CSAFPID-8505503", "CSAFPID-8505504" ] } ], "scores": [ { "cvss_v3": { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-10084444", "CSAFPID-10084445", "CSAFPID-10088332", "CSAFPID-10088333", "CSAFPID-10088334", "CSAFPID-10088335", "CSAFPID-10088840", "CSAFPID-10088841", "CSAFPID-10088842", "CSAFPID-10092238", "CSAFPID-1408881", "CSAFPID-6014972", "CSAFPID-6239276", "CSAFPID-8476917", "CSAFPID-8476920", "CSAFPID-8505503", "CSAFPID-8505504" ] } ], "title": "CVE-2026-123863" } ] }