CVE-2026-21714

{"id": "CVE-2026-21714", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2026-03-30T20:16:19.573", "references": [{"url": "https://nodejs.org/en/blog/vulnerability/march-2026-security-releases", "source": "support@hackerone.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2\u00b3\u00b9-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.\r\n\r\nThis vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25."}, {"lang": "es", "value": "Se produce una fuga de memoria en servidores HTTP/2 de Node.js cuando un cliente env\u00eda tramas WINDOW_UPDATE en el flujo 0 (a nivel de conexi\u00f3n) que hacen que la ventana de control de flujo exceda el valor m\u00e1ximo de 2\u00b3\u00b9-1. El servidor env\u00eda correctamente una trama GOAWAY, pero el objeto Http2Session nunca se limpia.\n\nEsta vulnerabilidad afecta a los usuarios de HTTP2 en Node.js 20, 22, 24 y 25."}], "lastModified": "2026-04-01T14:24:21.833", "sourceIdentifier": "support@hackerone.com"}