CVE-2026-21714

State: Published
Severity: 5.3 Medium
Published: Mar 30, 2026
Updated: Mar 31, 2026
Reserved: Jan 4, 2026

Description

A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http2Session object is never cleaned up.

This vulnerability affects HTTP2 users on Node.js 20, 22, 24 and 25.

Scores

CVSS	Score	Vector	Source
3.0	5.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	hackerone

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
nodenodejs	20.20.1 through 20.20.1Affected 22.22.1 through 22.22.1Affected 24.14.0 through 24.14.0Affected 25.8.1 through 25.8.1Affected

References

https://nodejs.org/en/blog/vulnerability/march-2026-security-releases

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.